OpenAM, an access management solution, exposes a logged-in user's raw session token through its Cross-Domain Single Sign-On (CDSSO) servlet. An attacker who gets an authenticated victim to visit a crafted URL can receive the token and may hijack the session. Exploitation requires CDSSO to be enabled, which is common in multi-domain deployments, and a non-default configuration that the sources do not name.
Open Identity Platform · OpenAM
Research and translation in progress – available shortly.
graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.
graphql-python · graphql-core
Research and translation in progress – available shortly.
joserfc, a Python library for JOSE standards such as JWS and JWE, allocates memory for copies of the header, payload and signature segments before its size limit rejects oversized compact tokens. An unauthenticated attacker can send very large tokens to services that parse them before verifying the signature, which can exhaust process memory and cause a denial of service. Confidentiality and integrity are not affected, and no code execution is possible.
Authlib · joserfc
joserfc is a Python library for JOSE standards. Before version 1.7.5, decrypt_json() processed every entry of a JWE General JSON recipients array without a count limit, performing one RSA private-key decryption per entry. An unauthenticated attacker who can submit JWE General JSON to an endpoint using an RSA key-management algorithm can choose the amount of CPU work per request and exhaust the service's CPU. The verify_all_recipients option does not limit this work, and there is no impact on confidentiality or integrity.
Authlib · joserfc
The project-graph analyzers of the Nx plugins @nx/maven and @nx/gradle start processes through a shell and insert plugin options from nx.json into command arguments without sanitizing them. An attacker who can get a user or CI job to run nx in a hostile repository or pull request can execute arbitrary commands with that user's privileges. Workspaces that do not register either plugin are not exposed.
Nrwl · Nx
Research and translation in progress – available shortly.
The dbt Cloud webhook of Lightdash accepts requests without authentication. Account and run identifiers from the request are inserted unsanitized into the dbt Cloud API URL, which is called with the project's API key, so path traversal changes the requested path on the fixed dbt Cloud host. An attacker who knows the projectUuid of a dbt Cloud IDE project can also create previews without authentication. Theft of the API key is claimed by the advisory but not confirmed by the available evidence. The UUID is not enumerable but can be exposed in shared or multi-tenant setups.
Lightdash · Lightdash
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
HashiCorp · Boundary
Bricks Theme 2.4 and earlier for WordPress exposes the load_popup_content REST endpoint without authentication or status checks. An anonymous attacker can request a public nonce and then iterate the popupId parameter to read draft and unpublished page content. The vulnerability affects any public WordPress site running a vulnerable version of the theme, and no user interaction is needed.
Bricks · Bricks Theme
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
pypdf, a pure-Python PDF library, can consume excessive memory when opening a crafted PDF whose cross-reference streams declare very large entry counts. An attacker can use this to cause a denial of service in applications that parse untrusted PDF files. No authentication is required, and the CNA rates the CVSS 4.0 score at 7.1 (High), with availability as the only impact.
py-pdf · pypdf
pypdf, a pure-Python PDF library, can consume excessive time and memory when an application reads the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. After decryption, the library trusts the declared count instead of walking the page tree. An attacker can cause denial of service by supplying such a file to an application that parses untrusted PDFs.
py-pdf · pypdf
pypdf, a pure-Python PDF library, can consume excessive memory when strict mode parses a crafted invalid PDF dictionary. Nested parsing failures repeat exception text in newly raised errors, so a small malformed dictionary can produce very large error messages. An attacker can exhaust memory and crash the processing application, which is a denial of service. This requires an application that parses untrusted PDFs with strict mode enabled.
py-pdf · pypdf
pypdf, a pure-Python PDF library, takes excessive time to retrieve page labels from a crafted PDF that contains a flat page-label number tree with many ranges. The page_labels property scans the same /Nums array repeatedly for every page, so the work grows with both the page count and the number of label ranges. An attacker can cause long runtimes (denial of service) by supplying such a file to an application that reads page labels; confidentiality and integrity are not affected. Exploitation requires user interaction, such as opening or processing the file.
py-pdf · pypdf
pypdf, a pure-Python library for processing PDF files, can enter an infinite loop when cloning or duplicating a specially crafted PDF with cyclic dictionary references. The cycle check compared generated destination references instead of the original source references, so some cycles were not detected. An attacker who can get such a file processed by an application using pypdf can exhaust the CPU of the worker process, which causes a hang or service degradation. Confidentiality and integrity are not affected, and no authentication is required if the application accepts PDFs from outside.
py-pdf · pypdf
pypdf versions before 6.21.4 can consume excessive memory when parsing a crafted PDF whose page tree contains many shared resources. Page-tree flattening copies page entries without a document-wide limit, so a single file can cause disproportionate allocations. An attacker who can get such a PDF processed by an application can cause a denial of service (crashed or slowed worker); no data is disclosed or modified, and the attack needs no privileges but requires that a user or application processes the file.
py-pdf · pypdf
pypdf, a pure-Python library for reading and processing PDF files, can enter an infinite loop when it opens a crafted, incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The parsing thread is blocked, which denies service to the application using the library. Exploitation requires that an application opens such a file, for example one uploaded by a user, and the impact is limited to availability.
py-pdf · pypdf
