Threats Tagged 'cwe-625'

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-82726 is a medium severity vulnerability in ash-project's ash_phoenix component. It involves a permissive regular expression used to parse the Host header, allowing a remote client to manipulate tenant selection or degrade requests by sending crafted Host headers. The root host pattern was interpolated unsafely, causing unintended matches and case sensitivity issues. This affects versions from 2.1.26 up to but not including 2.3.25.

CVE-2026-55536 is a critical improper access control vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 4.6.58, the Browser Server's _handle_connection() function incorrectly validates Chrome extension origins using an unanchored regular expression, allowing extra trailing characters to bypass checks. This flaw permits unauthorized start_session commands and browser automation. The issue is fixed in PraisonAI version 4.6.58.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That would have potentially allowed unauthorized commands to be executed.

CriticalVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2024-49400#cwe-625