RHSA-2026:86618
Vulnerability from csaf_redhat - Published: 2026-10-21 06:15 - Updated: 2026-10-21 09:02A flaw was found in Ceph. Certain misconfigurations of CORS rules in Ceph could result in a significantly large memory allocation. This issue can lead to RGW crashing and a denial of service from an authenticated user on the network.
CWE-20 - Improper Input Validation| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:4ea52cbdb1c42b970667045f794a8ad75d8d9df236a2d0e4751519a2c0904b87_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:8401aa351c60cbb096283b1efaefa0b44012a9487fbee8c8342b77bbdbfb6111_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:d6d5f168fb70e819659cdc47a64483b6509f3858b36df465e9c44533ab4af56c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:dbaea4a6d152c0a28f467dfc77b01d25aeebc0d0b7bb159c991771ff4a680c0d_s390x | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/alloy-rhel10@sha256:418bfcb3127da79a33297b2d48718b1de233c833fe9e4f0bf135974d254ad417_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/alloy-rhel10@sha256:b8de881870e89c0559238b5e45ec1a197b819b0d76ad1bbeb36732232bcd9ce3_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/alloy-rhel10@sha256:c44c3c02709d9effcee15e4c444d0933e4dc92200126256bc436a91315d661ce_ppc64le | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/alloy-rhel10@sha256:e1cbac58bcf8b551d5ea1b47f94798dcc632d81b38908f462e7d3e91771f60a4_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/grafana-rhel10@sha256:0fa88412ee250b79e9af3c426d74d2e838342fda5ebe1b99662ae3368ec2b480_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/grafana-rhel10@sha256:6f01015230f5c2ae3d75b9f0cae11538235e617a22d036dea04f6371769c1299_ppc64le | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/grafana-rhel10@sha256:bf7e7d9293a49520e6c07b6627cc1165b59d40b92ee15010a82735f8c4443602_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/grafana-rhel10@sha256:d5ecc8340af5598131845db29148b24b4a6da344ae9831c7ffd10a2847000208_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/keepalived-rhel10@sha256:215b4d293664a13186f738a02307ad686ecd8c18e3154778cefc5cd48098244a_ppc64le | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/keepalived-rhel10@sha256:41eb459a0560110c950039d3ea5b34e235d05a06dd4c2f2da7ef14fecc641bdc_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/keepalived-rhel10@sha256:6c9d48d718885dfb5ab96e434f2b6cf1006a878c36595020cf57a8b24108affd_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/keepalived-rhel10@sha256:97d8626437b17428366dccb70fc7d8eb22840623b164b491cceb66de07bc2279_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:6028e75c091f45e699c18817ab387fc267566c3a99f35cbc16dd6678eca52b04_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:7ffce56beb357c70924100d89b078786229036577b3fc5682fc9ffe937f9d011_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:ad80f5f61a2f2c3bb39c4d787fba18dc3a3d99ac688b07110b946ff3c8c31bc4_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:bde0c68d5c31070466d8708b1e5cdf94587d1a01464ec03d40ebf30f5c7e1b11_ppc64le | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:2dd73def241db73d57cdac5cfc8f7e9b32728de0b86007dd28a4a33d91680d4d_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:6e1f39f8225811070c27db40eba93cc567d44d43184ca10b317abad99ee0b485_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:8cffd72b960f38ac68d645e4a9bebefb41ea6ec86f6eade0e31e94e54eff9518_ppc64le | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:972e07ea652e5c12087fdfa32d1aba063ceb507e7b36ed55f2e54d46c663fce3_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:1cb7e79a5c02999ac479fdd43fa2b99c5ad88b7211e7ad8142cdfce833e83e7e_arm64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:3bf292a7d44614e5be829d1f3a4daeb2873405bd0886d0802bd32a9aacf6f781_amd64 | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:e5a4422325d975bb20f0ab152279748f6b33ec6b87d6419418917ab25c889e4a_s390x | — | ||
| Unresolved product id: Red Hat Ceph Storage 9.2:registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:f1b9bb921dd0c71c7c30b5880e9d15ac1f11be1fa1d6fccd8a4728a4df2369be_ppc64le | — |
A flaw was found in Ceph RGW. Using the x-amz-copy-source header to upload an empty object will cause Ceph RGW to crash, leading to availability issues.
A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature.
A flaw was found in nanoid. Affected versions of nanoid mishandles non-integer values. When nanoid is called with a fractional value, there were a number of undesirable effects: - In browser and non-secure, the code infinite loops on while (size--) - In node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled: when i is initialized to poolOffset, pool[i] & 63 -> undefined & 63 -> 0 - If the first call in node is a fractional argument, the initial buffer allocation fails with an error The highest impact of this issue system availability.
A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
A flaw was found in DOMPurify, a library designed to prevent web vulnerabilities. A remote attacker can exploit a cross-site scripting (XSS) vulnerability by bypassing the library's sanitization process. This bypass is possible due to improper validation of `textarea` rawtext elements, allowing attackers to inject malicious code. Successful exploitation could lead to arbitrary JavaScript execution in a user's browser, potentially compromising user sessions or disclosing sensitive information.
A flaw was found in DOMPurify. This vulnerability allows attackers to execute mutation-based Cross-site scripting (mXSS) via an incorrect template literal regular expression.
A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication (HMAC), making it vulnerable to the same class of unauthenticated-encryption attacks that compromised Kerberos 4 as documented in MIT's 2004 PERILS paper. An attacker who has compromised a single low-privilege CephX entity key can use the Ceph monitor as an encryption oracle by requesting tickets for specially-named entity identities over a standard network connection. The monitor encrypts these attacker-controlled names into ciphertext blocks which, due to absent integrity protection, can be spliced into forged credentials for privileged entities such as OSDs, MDSs, and MGRs. This grants cluster-wide access including data reads, data corruption, and full administrative control.
A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations.
A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination, leading to arbitrary URL redirection. Consequently, an attacker can redirect users to malicious websites. This vulnerability stems from a failure to constrain the redirect target.
A denial of service flaw has been discovered in the Axios npm package. When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.
A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
A flaw was found in node-forge. This vulnerability allows bypass of downstream Object Identifier (OID)-based security decisions via crafting Abstract Syntax Notation One (ASN.1) structures containing Object Identifiers (OIDs) with oversized arcs, which are then decoded as smaller, trusted OIDs due to 32-bit bitwise truncation.
A logic error exists in Angular’s built-in XSRF protection causes the framework to misclassify protocol-relative URLs (i.e. URLs starting with “//”) as same-origin. As a result, the client automatically appends and sends the XSRF token in an X-XSRF-TOKEN header to the remote domain — potentially attacker-controlled — enabling unauthorized disclosure of the token and bypass of CSRF protection.
A flaw exists in the template compiler of Angular as it fails to properly classify certain URL-bearing attributes (including SVG and MathML attributes such as href, xlink:href, or the attributeName of SVG animation elements) as requiring strict sanitization. As a result, an attacker who can supply untrusted data bound to those attributes may inject a malicious javascript: URL or script that persists (Stored XSS), which can execute in the context of the application's origin when rendered.
A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.
A cross site scripting flaw has been discovered in the DOMPurify npm library. This flaw allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassing decompression bomb safeguards. This issue leads to high memory and processor consumption, resulting in a Denial of Service (DoS) on the client.
A flaw was found in Angular. An attacker could exploit a cross-site scripting (XSS) vulnerability in the Angular Template Compiler due to improper sanitization of `href` and `xlink:href` attributes within SVG `<script>` elements. This could allow an attacker to inject malicious scripts into web pages, leading to arbitrary code execution in the user's browser.
A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
A flaw was found in minimatch, a utility for converting glob expressions into JavaScript regular expressions. A remote attacker can exploit this vulnerability by providing a specially crafted glob pattern containing multiple non-adjacent `**` (GLOBSTAR) segments. This can lead to unbounded recursive backtracking in the `matchOne()` function, causing a Denial of Service (DoS) by stalling the Node.js event loop for an extended period.
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript.
A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
A flaw was found in flatted, a JavaScript Object Notation (JSON) parser designed for handling circular data structures. A remote attacker can exploit this vulnerability by providing specially crafted JSON input. The parse() function in flatted fails to properly validate string values used as array index keys, allowing an attacker to manipulate internal JavaScript object prototypes. This prototype pollution can enable an attacker to execute arbitrary code or cause a denial of service, impacting the availability and integrity of affected systems.
A flaw was found in Picomatch, a JavaScript glob matcher. This Regular Expression Denial of Service (ReDoS) vulnerability allows a remote attacker to cause excessive CPU consumption and block the Node.js event loop, leading to a denial of service. This occurs when untrusted users supply crafted extglob patterns, specifically those using quantifiers like `+()` and `*()` combined with overlapping alternatives or nested extglobs, which can trigger catastrophic backtracking in the compiled regular expressions.
A flaw was found in picomatch, a JavaScript glob matcher. A remote attacker could exploit a method injection vulnerability by providing specially crafted POSIX bracket expressions, such as [[:constructor:]]. This allows the attacker to inject inherited method names into generated regular expressions, leading to incorrect glob matching behavior. This issue can cause security-relevant logic errors in applications that use picomatch for filtering, validation, or access control, potentially compromising data integrity.
A flaw was found in the node-forge library, a JavaScript implementation of Transport Layer Security. This vulnerability, inherited from the bundled jsbn library, allows a remote attacker to cause a Denial of Service (DoS). When the BigInteger.modInverse() function is called with a zero value, it enters an infinite loop, causing the process to hang indefinitely and consume 100% of the CPU resources.
A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.
A flaw was found in Forge (also called `node-forge`), a JavaScript library used for Transport Layer Security (TLS). The library's Ed25519 signature verification process does not correctly validate cryptographic signatures, allowing forged non-canonical signatures to be accepted. A remote attacker could exploit this signature malleability to bypass authentication and authorization logic. This vulnerability can also circumvent security checks in applications that rely on the uniqueness of cryptographic signatures for functions such as deduplication or preventing replay attacks.
A flaw was found in Forge (also known as node-forge), a JavaScript implementation of Transport Layer Security (TLS). The `pki.verifyCertificateChain()` function does not properly enforce certificate validation rules. This oversight allows an intermediate certificate that lacks specific security extensions to enable any leaf certificate to function as a Certificate Authority (CA) and sign other certificates. Consequently, node-forge could accept these unauthorized certificates as valid, potentially leading to spoofing or the issuance of illegitimate certificates.
A flaw was found in Axios, a promise-based HTTP client. A malicious server can exploit a state corruption bug within the HTTP/2 session cleanup logic, specifically in the Http2Sessions.getSession() method. By initiating concurrent session closures, the server can trigger a control flow error, leading to a client process crash. This vulnerability results in a Denial of Service (DoS) for the client application.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.
A flaw was found in DOMPurify, a software library used to clean potentially malicious code from web content, preventing Cross-Site Scripting (XSS) attacks. A remote attacker could exploit a vulnerability related to 'prototype pollution' to bypass DOMPurify's security checks. This allows the attacker to inject harmful code, such as event handlers, into web pages. If successfully exploited, this could lead to the execution of arbitrary code in a user's web browser.
A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template expressions like {{...}}, fails in these modes, allowing malicious content to bypass sanitization. This can lead to arbitrary code execution or information disclosure in applications utilizing template-evaluating frameworks such as Vue 2.
A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and execute arbitrary code in the user's browser, leading to Cross-Site Scripting (XSS).
A flaw was found in PostCSS. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by submitting specially crafted CSS. When PostCSS processes and re-stringifies this CSS for embedding within HTML `<style>` tags, it fails to properly escape `</style>` sequences. This oversight enables the injected `</style>` to prematurely close the HTML style block, allowing the attacker to inject malicious scripts and execute arbitrary code in the user's browser context.
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.
A flaw was found in Axios. A remote attacker can exploit this vulnerability by sending oversized streamed uploads. This occurs when the `maxRedirects` setting is configured to 0, which bypasses the `maxBodyLength` limit for stream request bodies. Consequently, the system will process the full oversized upload, potentially leading to a Denial of Service (DoS) by consuming excessive resources.
A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.
A flaw was found in Axios. When 'responseType: 'stream'' is used, Axios returns the response stream without enforcing the 'maxContentLength' limit. This allows a remote attacker to bypass configured response-size limits, leading to unbounded downstream consumption of resources. This vulnerability can result in a Denial of Service (DoS) due to excessive resource usage.
A flaw was found in Axios, an HTTP client for Node.js. A remote attacker, by controlling the type property of a file-like object, could inject arbitrary MIME part headers into multipart form data. This vulnerability arises from insufficient sanitization of carriage return and line feed (CRLF) sequences in the Content-Type header. This could lead to information disclosure by allowing the attacker to manipulate the structure of the multipart body.
A flaw was found in Axios, a software library used for making web requests. This vulnerability allows an attacker to bypass the `no_proxy` configuration, which is designed to prevent certain internal network requests from being sent through an external proxy. Specifically, when `no_proxy=localhost` is set, requests intended for local system addresses (such as 127.0.0.1 and [::1]) are still routed through the proxy. This could lead to unintended exposure of internal network traffic or sensitive information.
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
A flaw was found in Axios, a software component used for making web requests. This vulnerability allows for the incorrect handling of null bytes, where a safely encoded null byte (%00) is converted back to its raw form (\x00). While the standard use of Axios is not affected, this could lead to unexpected data processing or integrity issues in certain specialized applications. The overall impact of this flaw is considered limited.
CWE-76 - Improper Neutralization of Equivalent Special ElementsA flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
A flaw was found in Axios, a promise-based HTTP client. A remote attacker can exploit this vulnerability by manipulating the `withXSRFToken` configuration property to a truthy non-boolean value. This bypasses the same-origin check, causing Cross-Site Request Forgery (XSRF) tokens to be sent to attacker-controlled cross-origin servers. This could lead to information disclosure and unauthorized actions.
A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contains sensitive operational secrets including OSD LUKS disk encryption passphrases and, on clusters managed by cephadm, the SSH private key used to administer every host. Exposure of these secrets can lead to full host-level root access and compromise of encrypted data at rest.
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.
Loading 1.2 MB of JSON…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.