38,591 results · Feed
-
Unscored —
Hidden file disclosure through Windows short names
On Windows volumes with 8.3 short names, `actix_files::Files` can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as `ENV~1` or `GIT~1` passes this check. A remote client ca…
-
Unscored —
Compressed request bodies can exhaust memory before extractor limits apply
Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and ca…
-
High 8.2
Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cow…
-
High 8.7
Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machi…
-
Low 2.1
XML injection in Saxy via unescaped CDATA section terminator
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value pa…
-
Low 2.1
Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection
Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked ag…
-
Low 2.1
XML comment injection in Saxy encoder via unescaped double hyphen
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an in…
-
Unscored —
SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go
In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer…
-
Unscored —
Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml
github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing: 1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits …
-
Unscored —
Panic on negative member size in Reader.Read in github.com/blakesmith/ar
Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.…
-
Unscored —
Event type spoofing via UntrustedType in github.com/google/go-eventlog
In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can b…
-
Medium 6.9
Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a ve…
-
Medium 6.5
Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes …
-
High 7.5
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(..…
-
Critical 9.3
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which…
-
High 8.4
Broken Access Control in Canonical LXD DevLXD API
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.v…
-
Medium 6.5
Unbounded response body buffering in Streamable HTTP clients
Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming HTTP response bodies into memory with no size limit. Both the reqwest client (`transport-streamable-http-client-reqwest`) and the Unix socket client (`transport-streamable-http-clie…
-
Unscored —
`ocipkg` is unmaintained
The author of `ocipkg` has archived the repository and declared the crate no longer maintained. [Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release. "No further updates, including security fixes, are planned." ## Alternati…
-
Unscored —
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…
-
Unscored —
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…
-
Unscored —
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user wi…
-
Unscored —
The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditio…
-
Unscored —
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficientl…
-
Unscored —
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. T…
-
Unscored —
The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently …
-
Unscored —
The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. …
-
Unscored —
This module provides a separate page with a form for users to change their own password, which asks for the current pas…
-
Unscored —
This module enables you to schedule content to be published or unpublished at a certain time in the future. The module …
-
Unscored —
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The …
-
Unscored —
The Name Field module provides a field for storing a personal name as separate components. The module does not sufficie…
-
Unscored —
This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access fo…
-
Unscored —
This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently ver…
-
Unscored —
This module lets customers replace an item in their cart with one of the alternative product variations listed for it. …
-
Unscored —
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from Pa…
-
Unscored —
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suffici…
-
Unscored —
The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly re…
-
Unscored —
This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module do…
-
Unscored —
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with …
-
Unscored —
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypas…
-
Unscored —
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…