آخرین آسیب‌پذیری‌ها

OpenAM Session Hijacking via CDSSO

Incorrect Authorization

joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle

Boundary vulnerable to server-side request forgery in Vault credential store

Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication

MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

pypdf: Possible large memory usage when parsing cross-reference streams

pypdf: Possible long runtimes/large memory usage for encrypted PDF files

pypdf: Possible large memory usage for exceptions in strict mode

pypdf: Possible long runtimes when retrieving page labels

pypdf: Possible infinite loop when cloning dictionaries

Bricks Theme Broken Access Control via load_popup_content

pypdf: Possible large memory usage when parsing page tree

pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Nuxt dev server exposes generated appSecret through Vite file serving

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Nuxt dev server exposes private runtime config through the Nitro dev bundle