The dbt Cloud webhook of Lightdash accepts requests without authentication. Account and run identifiers from the request are inserted unsanitized into the dbt Cloud API URL, which is called with the project's API key, so path traversal changes the requested path on the fixed dbt Cloud host. An attacker who knows the projectUuid of a dbt Cloud IDE project can also create previews without authentication. Theft of the API key is claimed by the advisory but not confirmed by the available evidence. The UUID is not enumerable but can be exposed in shared or multi-tenant setups.
Lightdash · Lightdash
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
HashiCorp · Boundary
Bricks Theme 2.4 and earlier for WordPress exposes the load_popup_content REST endpoint without authentication or status checks. An anonymous attacker can request a public nonce and then iterate the popupId parameter to read draft and unpublished page content. The vulnerability affects any public WordPress site running a vulnerable version of the theme, and no user interaction is needed.
Bricks · Bricks Theme
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
pypdf, a pure-Python PDF library, can consume excessive memory when opening a crafted PDF whose cross-reference streams declare very large entry counts. An attacker can use this to cause a denial of service in applications that parse untrusted PDF files. No authentication is required, and the CNA rates the CVSS 4.0 score at 7.1 (High), with availability as the only impact.
py-pdf · pypdf
pypdf, a pure-Python PDF library, can consume excessive time and memory when an application reads the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. After decryption, the library trusts the declared count instead of walking the page tree. An attacker can cause denial of service by supplying such a file to an application that parses untrusted PDFs.
py-pdf · pypdf
pypdf, a pure-Python PDF library, can consume excessive memory when strict mode parses a crafted invalid PDF dictionary. Nested parsing failures repeat exception text in newly raised errors, so a small malformed dictionary can produce very large error messages. An attacker can exhaust memory and crash the processing application, which is a denial of service. This requires an application that parses untrusted PDFs with strict mode enabled.
py-pdf · pypdf
pypdf, a pure-Python PDF library, takes excessive time to retrieve page labels from a crafted PDF that contains a flat page-label number tree with many ranges. The page_labels property scans the same /Nums array repeatedly for every page, so the work grows with both the page count and the number of label ranges. An attacker can cause long runtimes (denial of service) by supplying such a file to an application that reads page labels; confidentiality and integrity are not affected. Exploitation requires user interaction, such as opening or processing the file.
py-pdf · pypdf
pypdf, a pure-Python library for processing PDF files, can enter an infinite loop when cloning or duplicating a specially crafted PDF with cyclic dictionary references. The cycle check compared generated destination references instead of the original source references, so some cycles were not detected. An attacker who can get such a file processed by an application using pypdf can exhaust the CPU of the worker process, which causes a hang or service degradation. Confidentiality and integrity are not affected, and no authentication is required if the application accepts PDFs from outside.
py-pdf · pypdf
pypdf versions before 6.21.4 can consume excessive memory when parsing a crafted PDF whose page tree contains many shared resources. Page-tree flattening copies page entries without a document-wide limit, so a single file can cause disproportionate allocations. An attacker who can get such a PDF processed by an application can cause a denial of service (crashed or slowed worker); no data is disclosed or modified, and the attack needs no privileges but requires that a user or application processes the file.
py-pdf · pypdf
pypdf, a pure-Python library for reading and processing PDF files, can enter an infinite loop when it opens a crafted, incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The parsing thread is blocked, which denies service to the application using the library. Exploitation requires that an application opens such a file, for example one uploaded by a user, and the impact is limited to availability.
py-pdf · pypdf
The @hapi/content library, used by the hapi Node.js framework and by @hapi/pez for multipart/form-data parsing, has a flaw in Content.disposition(). A Content-Disposition header with a long parameter token that has no equals sign causes quadratic processing that can block the Node.js event loop. An unauthenticated remote attacker can stall a single-instance service with one crafted multipart request, and applications that pass untrusted headers directly to Content.disposition() are also affected.
hapi project · @hapi/content
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The containerized OpenShift installer downloads inventory and dynamic scripts from remote URLs and runs them without verifying their integrity. An attacker with a Man-in-the-Middle position on the network, or control of the script server, can substitute a malicious executable. It then runs with the installer's user ID and full cluster-provisioning privileges, which allows arbitrary code execution. The risk only applies where INVENTORY_URL or DYNAMIC_SCRIPT_URL is used.
Red Hat · openshift-ansible
IDrive Backup for Windows up to and including version 7.0.1.1 contains a vulnerability in the id_service.exe component that allows a local attacker to execute arbitrary code. An attack requires a local user account on the affected Windows system; the network is not exposed. The issue is fixed in version 7.0.1.2. The CVSS score and CWE classification are provisional because NVD analysis is still pending.
IDrive · IDrive Backup for Windows
IDrive Backup for Windows version 7.0.1.1 and below contains a flaw in the id_service.exe component that allows a local attacker to execute arbitrary code. According to the researcher's write-up, insecure serialization and deserialization of data sent to the local service allows injected code to run with SYSTEM privileges. The attacker needs a logon with low privileges on the affected system; the service is not reachable from remote systems. Version 7.0.1.2 fixes the issue.
IDrive · Backup for Windows
