Base de CVEs

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates lazily, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs in its own constructor. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering therefore never executed on endpoint-configured routes: the strategy object was constructed and immediately replaced before it could be consulted. The consequence is that the legacy websocket. Exchange-header prefix was not filtered at the undertow transport boundary in either direction, so an undertow HTTP consumer mapped inbound wire headers of that form onto the Exchange, where an undertow WebSocket producer reads them as dispatch directives and can be made to deliver to a peer other than the one the route selected; and header names that undertow itself does not accept were mapped onto the Exchange rather than being skipped. Rest DSL consumers were never affected, because UndertowComponent assigns UndertowRestHeaderFilterStrategy explicitly, which extends the undertow strategy. This is not a regression of CVE-2025-30177: the base HttpHeaderFilterStrategy configures the inbound Camel-prefix filter itself, so the protection introduced by that advisory continued to work through the base class and was never lost. What the change did was leave the undertow strategy orphaned on the endpoint path, with the effect that two subsequent corrections written into it - one skipping header names undertow rejects, one filtering the legacy websocket. prefix in both directions - were applied to a class the endpoint no longer used and never took effect in the releases that shipped them. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, configure the strategy explicitly rather than relying on the default, for example by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endpoint as undertow:http://0.0.0.0:8080/foo?headerFilterStrategy=#myStrategy, and additionally strip the dispatch headers at the trust boundary with removeHeaders(“websocket.*”). Note a residual limitation that upgrading does not remove: the undertow component deliberately keeps the websocket. values as part of its externally visible API contract, and UndertowProducer reads them with in.getHeader, which does not consult a HeaderFilterStrategy at all. The restored filtering is therefore defence in depth at the undertow transport boundary only. A route that carries an untrusted message from a non-undertow consumer into an undertow producer is not protected by this fix and must strip those headers itself.

Vulnerabilidade de validação imprópria de entrada no componente Apache Camel Atmosphere Websocket. Este problema afeta o Apache Camel: de 4.0.0 antes de 4.14.9, de 4.15.0 antes de 4.18.4, de 4.19.0 antes de 4.22.0. O produtor camel-atmosphere-websocket seleciona para quais pares WebSocket conectados uma mensagem é entregue por meio de cabeçalhos do Exchange, e os valores em string desses cabeçalhos estavam fora do namespace Camel: websocket.connectionKey e websocket.connectionKey.list, além de websocket.sendToAll, websocket.eventType e websocket.errorType. WebsocketEndpoint estende ServletEndpoint e, por isso, herda HttpHeaderFilterStrategy, que filtra apenas os prefixos Camel e camel; os nomes com ponto ficaram, portanto, fora do namespace filtrado e foram admitidos em ambas as direções por todo consumidor da família HTTP. Em uma rota que conecta um consumidor HTTP a um produtor atmosphere-websocket, um remetente externo poderia fornecer o cabeçalho de lista e assumir a decisão de despacho do produtor. WebsocketProducer.process testa o cabeçalho de lista antes do cabeçalho de chave única, portanto um valor injetado descartava o destinatário que a rota havia selecionado: uma notificação destinada a um cliente conectado poderia ser suprimida ou entregue a outro cliente cuja chave de conexão o remetente conhece. O cabeçalho não precisa ser um parâmetro de consulta nem ser fornecido literalmente como lista. O binding HTTP do Camel promove um nome de cabeçalho repetido, e um valor entre colchetes, para List ao mapear para o Exchange, de modo que um cabeçalho HTTP de entrada comum basta para alcançar o ramo com valor de lista. Isto é distinto de CVE-2026-55993, que trata do caminho de parâmetros de consulta no lado do consumidor do mesmo componente. O comportamento remonta à introdução dessas constantes, lançadas pela primeira vez na versão 2.17.0, e permaneceu inalterado até esta correção. Os usuários são recomendados a atualizar para a versão 4.22.0, que corrige o problema. Se os usuários estiverem na linha de releases LTS 4.14.x, sugere-se atualizar para 4.14.9. Se estiverem na linha de releases 4.18.x, sugere-se atualizar para 4.18.4. Para implantações que não podem atualizar imediatamente, remova os cabeçalhos de despacho na fronteira de confiança, antes do produtor, por exemplo com removeHeaders(“websocket.*”) posicionado entre o consumidor HTTP e o produtor atmosphere-websocket. Observe que a correção renomeia os valores de string dos cabeçalhos para o namespace Camel, o que é uma mudança incompatível para rotas que os definem por string literal; rotas que referenciam os campos de WebsocketConstants simbolicamente não são afetadas, e a mudança está documentada nos guias de atualização. Como defesa em profundidade, não conecte diretamente um consumidor HTTP não confiável a um produtor WebSocket cujo despacho seja guiado por cabeçalhos sem remover antes o namespace de despacho.

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.

Múltiplas vulnerabilidades em versões afetadas do Zscaler Client Connector permitem execução remota de código, dando a um usuário não autenticado e sem privilégios a capacidade de executar código arbitrário no contexto do ZCC.

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.

justhtml anterior à 1.15.0 contém múltiplos problemas de segurança em auxiliares de sanitização de URLs (clean_url_value/clean_url_in_js_string), na serialização HTML, na passagem de Markdown (html_passthrough=True) e em diversos casos de borda de políticas de sanitização personalizadas. Dependendo da configuração, um atacante pode contornar a sanitização para injetar HTML e JavaScript ativos, por exemplo por meio de URLs javascript: codificadas, URLs relativas com barra invertida resolvidas como hosts remotos, nomes programáticos de elementos ou atributos que quebram a marcação, comentários HTML, reintrodução de </textarea> bruto pela passagem de Markdown, ou tags <style>, <meta http-equiv=refresh> e <base href> preservadas em políticas personalizadas. A maioria dos problemas em políticas personalizadas não afeta a configuração padrão sanitize=True; eles afetam principalmente APIs auxiliares, construção programática de DOM, html_passthrough=True e políticas e pipelines de transformação personalizados.

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.