Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the parsing process of WS-Policy documents containing deeply nested policy elements. An attacker can cause the application to exhaust the thread stack and crash the parser by submitting specially crafted...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the absence of a total timeout in the remote policy fetch process. An attacker can cause the application to hang indefinitely by making a server respond extremely slowly, there...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the normalization. An attacker can exhaust system resources by submitting a specially crafted WS-Policy document containing repeated policy references that trigger exponential...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the processing of WS-Policy documents containing excessive content within policy assertions. An attacker can cause memory exhaustion by submitting specially crafted documents...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.apache.mina:mina-core is a network application framework which helps users develop high performance and high scalability network applications easily. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML2array function. An attacker can access sensitive local files, initiate server-side requests, or cause resource exhaustion by submitting specially crafted XML metadata. Details XXE Injection ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the shell-out handlers process. An attacker can execute arbitrary operating system commands by supplying specially crafted filenames containing shell metacharacters. Remediation Upgrade james-heinrich/getid3 to...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via SamplingParams.updatefromtokenizer, which fails to validate badwords token indices against the model's...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

Cross-site Scripting (XSS)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient server-side HTML escaping in the JSX rendering pipeline. Untrusted values - including array roots, boundary objects, fallback objects, and provid...

Cross-site Scripting (XSS)

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient server-side HTML escaping in the JSX rendering pipeline. Untrusted values - including array roots, boundary objects, fallback...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the newVolume process in the Docker volume plugin when the name field of a VolumeDriver.Create request is not properly validated. An attacker can cause the creation and mounting of a remote...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the handling of directory listing responses. An attacker can write files outside the intended destination root by crafting object names containing forward slashes and parent directory references. Details A...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via the stoptokenids and allowedtokenids parameters in vllm/samplingparams.py, which are not validated against th...

Out-of-bounds Write

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Out-of-bounds Write via the Triton bincountkernel, where prompt token IDs index the penalty prompt-presence bitset without bounds checking against t...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the maxMessagePayloadSize limit is enforced against the compressed wire size of a permessage-compressed WebSocket frame rather than...

Allocation of Resources Without Limits or Throttling

Overview crossbar is a Crossbar.io multi-protocol WAMP/WebSocket, REST/HTTP, MQTT application router for microservices. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the EditAction process of the comments plugin when the cb parameter is base64-decoded and passed to unserialize without restricting allowed classes. An attacker can execute arbitrary code or write...

Sensitive Information in Resource Not Removed Before Reuse

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse via the viewInfo operation in...

Sensitive Information in Resource Not Removed Before Reuse

Overview org.webjars.npm:devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse via the viewInfo operation...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the ratings.ajax.php process. An attacker can manipulate rating data on behalf of authenticated users by enticing them to visit a crafted web page that automatically submits unauthorized POST requests...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redir: prefix in page bodies. An attacker can redirect users to arbitrary external sites by creating or editing pages, potentially facilitating phishing attacks. Remediation There is no fixed version for...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the coturlcheck function. An attacker can redirect users to attacker-controlled hosts by supplying specially crafted hostnames that begin with the site domain, bypassing the intended redirect validation. Remediation...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the contact submission handler. An attacker can cause unauthorized actions to be performed on behalf of an authenticated user by tricking the user into visiting a malicious page that submits forged...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the users.passrecover.php process. An attacker can reset any account password, including administrators, by precomputing candidate tokens within a narrow time window...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

Improper Encoding or Escaping of Output

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences in...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via CSSStyleDeclaration.setProperty, which fails to validate reserved property names. An attacker can supply a stylesheet containing a declaration named length, replacing the internal...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via CSSStyleDeclaration.setProperty, which fails to validate reserved property names. An attacker can supply a stylesheet containing a declaration named length, replacing the internal...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the varyMatches function, which fails to properly handle Vary: wildcard headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via mergeObject, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a proto key in a merge operation, injecting attacker-controlled...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via mergeObject, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a proto key in a merge operation, injecting attacker-controlled...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the varyMatches function, which fails to properly handle Vary: wildcard headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the doUpgrade process. An attacker can inflate their credit balance by sending multiple concurrent downgrade requests, resulting in multiple refunds for a single legitimate downgrade. Remediation Upgrade...

Uncontrolled Recursion

Overview braces is a Bash-like brace expansion, implemented in JavaScript. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to...

Uncontrolled Recursion

Overview org.webjars.npm:braces is a Bash-like brace expansion, implemented in JavaScript. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line separators U+2028 or paragraph separators U+2029. An attacker can trigger this by passing such a path to...

Infinite loop

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the aresdnsnameparse function due to a lack of limits on the total pointer hops or assembled name length when processing DNS compression pointers. An attacker can cause excessive C...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the aresdnsparse function. An attacker can cause excessive heap memory allocation and degrade or deny name resolution services by sending specially crafted DNS responses with...

Memory Allocation with Excessive Size Value

Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced b...

Memory Allocation with Excessive Size Value

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's...

Incorrect Privilege Assignment

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the openprocess function in src/anyio/core/subprocesses.py, where the extragroups parameter is silently...

Improper Validation of Certificate with Host Mismatch

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via TLSStream.wrap in src/anyio/streams/tls.py, which resolves international domain nam...

Allocation of Resources Without Limits or Throttling

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in processworker within src/anyio/toprocess.py, where stderr in a worker subprocess is...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the smwtask API module, which lacks proper authorization checks. An attacker can access internal database statistics, enqueue and execute maintenance jobs, and modify stored semantic data by sending...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:FacetedSearch process. An attacker can inject arbitrary HTML or JavaScript into the response by crafting a request with malicious cstate parameters that are not properly escaped, leading to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Special:Ask process when a forged cursor pagination token is supplied. An attacker can execute arbitrary scripts in the victim's browser by crafting a malicious link containing a specially crafted cursor...