Vyper input validation error vulnerability

A input validation error vulnerability exists in VyperLang Vyper versions 0.4.0b1 through 0.5.0b1. This vulnerability arises because parseName parses the names of constants and default parameters from imported modules at the function call site rather than at their declaration site. When contract...

Traefik Labs Traefik processing logic error vulnerability

Traefik Labs Traefik versions prior to 2.11.58 and prior to 3.7.13 contain a logic error vulnerability. This vulnerability arises because a negative Host match is treated as a registered domain, allowing unauthenticated clients to bypass client certificate validation. When routing rules containin...

Drupal Central Authentication System Server input validation error vulnerability

The Drupal Central Authentication System Server versions prior to 0.0.0 and 2.0.4, as well as versions prior to 2.1.0 and 2.1.3, contain an input validation error vulnerability. This vulnerability stems from URL redirection to untrusted sites open redirect, potentially leading to forged data...

GraphQL Python GraphQL-core 3 resource management error vulnerability

In GraphQL Core for Python versions 3.0.0 through 3.2.12 and 3.3.0a1 through 3.3.0rc1, there is a resource management error vulnerability. This vulnerability stems from the OverlappingFieldsCanBeMerged rule during validation; it repeatedly compares shared response fields and recursively recompare...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail only strips line breaks from the Subject and Organization headers, failing to sanitize other header values receiv...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 within the 1.7.x series. This vulnerability arises because the flag parameter in the mail/mark action fails to filter CRLF sequences, potentially allowing remote authenticated...

Drupal Webform resource management error vulnerability

Versions of Drupal Webform prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain a resource management error vulnerability. This vulnerability stems from unrestricted or throttled resource allocation, potentially leading to excessive resource consumption...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from incomplete recognition of CSS escape sequences when processing the FuncIRI attribute, allowing remote content to be bypassed. As a...

PHPOffice PhpSpreadsheet input validation error vulnerability

PHPOffice PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and earlier versions prior to 5.10.0 contain a security vulnerability. This vulnerability arises because the DOCTYPE detection mechanism in XmlScanner::scan fails to account for ISO-2022 escaped sequences within XLSX XML sections. A...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from an email header injection issue during Bounce operations. The function rcubemime::decodeaddresslist fails to remove control characte...

Silicon Labs EmberZNet buffer error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises from specially crafted Publish Price Matrix commands that lead to out-of-bounds writes, potentially enabling remote code execution...

Drupal SAML SSO – Service Provider input validation error vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain an input validation error vulnerability. This vulnerability stems from URL redirection to untrusted sites open redirect, potentially allowing attackers to forge data sources...

Lexi Wilson exposed a resource management error vulnerability

Lexi Wilson has identified a resource management error vulnerability in versions 0.1.0 and later of esaml. This vulnerability arises because when esamlbinding:decoderesponse/2 uses xmerlscan:string/2 to parse SAML Responses, it registers element names, attribute names, and namespace prefixes as...

Roundcube Webmail Project Roundcube Webmail Cross-site Scripting Vulnerability

The Roundcube Webmail project contains a cross-site scripting vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because the error messages returned by the password driver in the password plugin are concatenated into user messages without proper HTML...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcubewashtml fails to validate the by attribute in SVG SMIL animations; as a result, tags within HTML emails can load remote...

KNIME Business Hub resource management error vulnerability

Versions prior to KNIME Business Hub 1.19.0 contain a resource management error vulnerability. This vulnerability stems from an excessive resource allocation issue in the remote workflow editing functionality. Authenticated attackers can exploit this flaw to exhaust server-side resources, resulti...

GitLab input validation error vulnerability

GitLab CE/EE versions prior to 10.1 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper input sanitization during LDAP email lookup in the OmniAuth identity link process. When both OmniAuth SAML and...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises from using the subject line of forwarded emails verbatim to generate attachment names. When the subject contains a CRLF sequence, it may...

LiteSpeed Tech “Resource Management Error” vulnerability

LiteSpeed Tech versions prior to 4.9.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP/3 implementation fails to limit the number of buffer header sets, potentially leading to excessive memory consumption and susceptibility to QPACK amplification...

GitLab input validation error vulnerability

A input validation error vulnerability exists in GitLab CE/EE versions from 18.3 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from improper trust of user-supplied values when constructing endpoint URLs within...