Amazon AWS MCP Server input validation error vulnerability

The Amazon AWS MCP Server contains an input validation error vulnerability. This vulnerability stems from an incomplete whitelist of disallowed inputs within the Python code validator in the runscript tool, potentially allowing authenticated remote users to execute arbitrary code within their...

Eclipse KeyPont - GOSE input validation error vulnerability

Eclipse KeyPont – Versions 0.7.5 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 contain an input validation error vulnerability. This vulnerability arises because JwksTrustStore.Get assigns parsed keys to named return values when refreshing the JWKS cache. When a requested key does not exist,...

Eclipse KeyPont - GOSE input validation error vulnerability

Eclipse KeyPont – Versions 0.9.0 through 0.13.0-rc1 and versions prior to 1.0.0-rc1 contain an input validation error vulnerability. This vulnerability arises because the JweDirectDecryptorBlock.Decrypt function reads a 64-bit plaintext length from protected header fields of thalesaad without...

Craft CMS Mollie for Craft Commerce input validation error vulnerability

Versions 2.1.1 through 4.4.3 of Craft CMS Mollie for Craft Commerce contain an input validation error vulnerability. This flaw arises because the Mollie webhook endpoint fails to verify whether the commerceTransactionHash and id parameters match. As a result, unauthenticated attackers can pair an...

Mervin Praison PraisonAI input validation error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions 4.5.2 through 4.6.59. This vulnerability stems from improper handling of DiscordApproval approval logic; it fails to associate approval messages with requests. Any user capable of accessing a configured Discord channel can appro...

i18next-http-backend input validation error vulnerability

Version 4.0.2 of i18next-http-backend contains an input validation error vulnerability. This flaw stems from an incomplete fix in interpolateUrl, allowing attackers to redirect translation requests by providing a ns value starting with a slash. As a result, protocol-relative URLs hosted by...

VideoLAN VLC for Android input validation error vulnerability

Versions of VideoLAN VLC for Android prior to 3.7.2 contain an input validation error vulnerability. This vulnerability arises because FileUtils.getUri trusts content URIs solely based on com.fsck.k9.attachmentprovider or gmail-ls authority. Unauthorized applications can exploit this by declaring...

Zimbra Collaboration Suite input validation error vulnerability

Zimbra Collaboration Suite ZCS versions 10.1.20 and earlier contain an input validation error vulnerability. This vulnerability stems from improper validation of the emailAddress input in the data source test functionality. It allows authenticated regular users to inject CR/LF sequences into SMTP...

Intranda goobi-viewer-core input validation error vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 4.11.0 up to and including version 26.05. This vulnerability arises because multiple Jakarta WebSocket endpoints fail to verify that associated Http Sessions belong to logged-in users, nor do they validate the Origin head...

Eclipse KeyPont - GOSE input validation error vulnerability

Eclipse KeyPont – Versions 0.7.3 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 of GOSE contain a security vulnerability. This vulnerability arises because the JWS Crit header is parsed but not read, resulting in tokens containing unsupported critical extension parameters being accepted inste...

OLo Uni-CLI input validation error vulnerability

A security vulnerability exists in OLo Uni-CLI versions prior to 0.225.2. This vulnerability arises because when old JSON-RPC-over-HTTP MCP transmissions are exposed to the loopback address, the browser Origin header is not validated prior to routing requests. As a result, malicious web pages can...

Twisted input validation error vulnerability

Versions of Twisted prior to 26.10.0rc1 contain an input validation error vulnerability. This vulnerability stems from the fact that twisted.web.http.HTTPChannel.headerReceived accepts raw carriage returns or line feeds in HTTP header values and splits header lines only on CRLF. This may lead to...

Diego Nehab rply input validation error vulnerability

Diego Nehab: Versions 1.1.4 and earlier contain an input validation error vulnerability. This flaw stems from improper array index validation in the plyreadheaderproperty function; it accepts a list as the length or value type for list properties. An attacker can supply a specially crafted PLY...

Zimbra Collaboration Suite input validation error vulnerability

Zimbra Collaboration Suite versions 10.1.17 and earlier contain an input validation error vulnerability. This vulnerability stems from request attribute overwriting; unauthenticated requests containing /h/ can overwrite the servlet attributes intended for trusted internal scheduling. RestFilter...

Dimitrij Drus Heimdall input validation error vulnerability

Versions of Dmitry Drus Heimdall prior to 0.17.17 contain an input validation error vulnerability. This vulnerability arises when constructing a Forwarded HTTP header under proxy mode without removing commas and semicolons from the request’s Host header value. As a result, it may allow injection ...

Part-DB input validation error vulnerability

Versions of Part-DB prior to 2.13.2 contain an input validation error vulnerability. This flaw arises from the failure to sanitize spreadsheet formula characters within the part import/export workflows. Authenticated users with import privileges can upload CSV files containing formula prefix...

Gede Lumbung HospitalManagement input validation error vulnerability

There is an input validation error vulnerability in Gede Lumbung HospitalManagement. This vulnerability stems from improper handling of the ‘urlroute’ parameter by the ‘simpan’ function in the file application/modules/admin/controllers/routingpages.php within the URL Validation component. It may...

Lookyloo input validation error vulnerability

Versions prior to Lookyloo 1.39.4 contain an input validation error vulnerability. This vulnerability arises because unauthenticated users can pass the email and comment parameters via the /json//report API endpoint incorrectly, thereby overwriting the asadmin parameter. When asadmin is set to...

AgentFront mcp-from-openapi input validation error vulnerability

In AgentFront versions mcp-from-openapi from 2.2.0 up to 2.9.0, there is an input validation error vulnerability. This vulnerability arises because it is possible to bypass the ssrf.blockedHosts list by using a trailing hostname. When attackers control the OpenAPI specification URL or redirect...

GitLab input validation error vulnerability

Versions 17.4 prior to GitLab EE 19.3.6, version 19.4 prior to 19.4.3, and version 19.5 prior to 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper access control during synchronization of approval rules, potentially allowing authenticated users to bypa...