Origin Validation Error

Overview next is a react framework. Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware endpoint /next/mcp, where insufficient host validation allows a DNS rebinding attack. An attacker who controls a malicious DNS server can cause a victim's browser...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys to their source route in base-server.ts and related export/build pipeline files. When multiple routes share a cache...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the use-cache-wrapper.ts cache function, where draft mode state is not accounted for when sharing cached fills across concurrent...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's cache key generation logic, where cache keys are not bound to their source route. An attacker can...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the listpagestag and includepages actions in the tags tool. An attacker can access the names and body-derived titles of pages that are protected by access control lists by embedding these actions with a chosen...

Prototype Pollution

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by supplying a crafted map key during deserialization, potentially leading to arbitrary property injection or alteration of applicatio...

Prototype Pollution

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of...

NULL Pointer Dereference

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to NULL Pointer Dereference in the thriftprotocol process. An attacker can cause a crash or denial of service by sending specially crafted data that triggers a dereference of a missing...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the thriftprotocol process. An attacker can cause a crash or denial of service by sending specially crafted data that triggers a dereference of a missing container-element specification. Remediation Upgrade...

Improper Certificate Validation

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Certificate Validation in the host name check, which stops taking effect on Python 3.12 and later and reports success rather than signalling that no check was performed. An...

Infinite loop

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can cause the Node server's event loop to become unresponsive by sending specially crafted JSON input with a member name that triggers...

Infinite loop

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. ...

Data Amplification

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Data Amplification in TZlibTransport, whose decompressed size limit stops being enforced once the limit has been exactly consumed, so decompression past that point proceeds unbounde...

Allocation of Resources Without Limits or Throttling

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper enforcement of the maxStringSize configuration in the thriftprotocol C extension. An attacker can cause excessive memory...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper enforcement of the maxStringSize configuration in the thriftprotocol C extension. An attacker can cause excessive memory consumption by sending specially crafted data...

Inefficient Algorithmic Complexity

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to inefficient handling in the buffer process. An attacker can cause excessive resource consumption by sending specially crafted input that triggers...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to inefficient handling in the buffer process. An attacker can cause excessive resource consumption by sending specially crafted input that triggers repeated buffer re-slicing operations. Remediati...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a string size bound in the TJsonProtocol process. An attacker can cause excessive memory consumption by sending specially crafted large strings. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a string size bound in the TJsonProtocol process. An attacker can cause excessive memory consumption by sending...

Infinite loop

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Infinite loop in the Python TNonblockingServer, which busy-loops and stops selecting on any of its file descriptors once a frame ends exactly on an 8192 byte boundary. An attacker c...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper management of the line buffer in the C++ THttpTransport process. An attacker can cause excessive memory consumption and potentially crash the application by sending...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to improper handling of messages in the multiplexed processor. An attacker can cause the application to crash by sending a message that cannot be routed. Remediation Upgrade thrift to version 0.25.0 or highe...

Uncontrolled Recursion

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Uncontrolled Recursion due to missing recursion-depth checks in the TProtocol::skipBinary process. An attacker can cause excessive resource consumption or application crash by sending special...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to missing recursion-depth checks in the TProtocol::skipBinary process. An attacker can cause excessive resource consumption or application crash by sending specially crafted data that triggers deep or infinit...

Allocation of Resources Without Limits or Throttling

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a size limit ...

Directory Traversal

Overview ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java. Affected versions of this package are vulnerable to Directory Traversal via unsanitized input in the MDCDiscriminator process. An attacker can create or append log files outside the intende...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the decompression. An attacker can exhaust system resources and render the service unavailable by sending specially crafted, highly compressed data payloads. Remediation...

Allocation of Resources Without Limits or Throttling

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readJSONString and readJSONNumericChars methods of TJSONProtocol, which accumulate a value byte by byte without counting ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readJSONString and readJSONNumericChars methods of TJSONProtocol, which accumulate a value byte by byte without counting it against the configured string size limit, a limit th...

Allocation of Resources Without Limits or Throttling

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readJSONString and readJSONNumericChars methods of TJSONProtocol, which accumulate a...

Allocation of Resources Without Limits or Throttling

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readJSONString and...

Access of Uninitialized Pointer

Overview Affected versions of this package are vulnerable to Access of Uninitialized Pointer in the cglib bindings when processing specially crafted input that leads to access of an uninitialized pointer. An attacker can cause the application to crash by sending malicious data to the affected...

Out-of-bounds Write

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Out-of-bounds Write due to an integer overflow in the PHP bindings that results in a stack-based buffer overflow when processing specially crafted data. An attacker can cause the service to...

Allocation of Resources Without Limits or Throttling

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of skipped fields in incoming messages due to a failure to enforce recursion limits. An attacker can cause sta...

Allocation of Resources Without Limits or Throttling

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of skipped fields in incoming messages due to a failure to enforce recursion limits. An attacker can cause stack...

Improper Handling of Exceptional Conditions

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to improper handling of exceptional...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the TProtocolUtil.skip process. An attacker can cause excessive resource consumption or application crash by sending data with deeply nested structures. Remediation Upgrade org.apache.thrift:thrift to version...

Allocation of Resources Without Limits or Throttling

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of size bounds in the TJSONProtocol string and number readers. An attacker can cause excessive resource consumption by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of size bounds in the TJSONProtocol string and number readers. An attacker can cause excessive resource consumption by sending specially crafted JSON input. Remediatio...

Uncaught Exception

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Uncaught Exception due to improper handling of exceptions in the TSimpleServer process. An attacker can cause the entire server process to terminate unexpectedly by triggering a non-transport...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to improper handling of exceptions in the TSimpleServer process. An attacker can cause the entire server process to terminate unexpectedly by triggering a non-transport exception. Remediation Upgrade thrift to...

Improper Validation of Specified Quantity in Input

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attacker can cause...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attack...

Uncaught Exception

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Uncaught Exception in the web server, which registers no error listener on a socket after it has been...

Allocation of Resources Without Limits or Throttling

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of limits on SAS...

Allocation of Resources Without Limits or Throttling

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in TFramedTransport.Read in lib/go/thrift/framedtransport.go and THeaderTransport.Read in...

Improper Handling of Length Parameter Inconsistency

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the WebSocket transport. An attacker can exhaust...

Improper Handling of Length Parameter Inconsistency

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the WebSocket transport. An attack...