CWE-755

{
  "affected": [],
  "aliases": [
    "CVE-2022-44030"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-06T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.",
  "id": "GHSA-hq3g-q9w3-58pc",
  "modified": "2022-12-08T21:30:20Z",
  "published": "2022-12-07T00:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44030"
    },
    {
      "type": "WEB",
      "url": "https://www.redmine.org/news/139"
    },
    {
      "type": "WEB",
      "url": "https://www.redmine.org/projects/redmine/wiki/Security_Advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Steeltoe.Discovery.Eureka"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81515"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:30:45Z",
    "nvd_published_at": "2026-09-17T16:17:46Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nSteeltoe\u0027s Eureka discovery client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed (for example, an unrecognized `actionType`, a non-boolean value for `isCoordinatingDiscoveryServer`, or a non-numeric timestamp), deserialization of the entire registry fails. All Steeltoe Eureka clients connected to that registry then receive an empty or stale instance list until the malformed registration is removed.\n\nThis is a related but distinct issue from [CVE-2026-50196](https://github.com/advisories/GHSA-j8ph-6fxj-g533), which addressed only the `DataCenterInfo.name` field.\n\n## Impact\n\nAny principal that can register or update a service instance in the Eureka registry can trigger a service-discovery outage for all Steeltoe applications connected to the same registry. The outage persists until the offending registration is removed.\n\n## Affected configuration\n\n* Application uses `EurekaDiscoveryClient` (any deployment, including self-hosted Eureka).\n* The registry contains at least one service instance with an unrecognized value in a field such as `actionType`, `status`, `isCoordinatingDiscoveryServer`, or timestamp fields.\n* Mixed-platform environments \u2014 for example, Java or Spring services co-existing in the same Eureka registry \u2014 are more likely to encounter this condition.\n\n## Mitigations\n\nIf an immediate upgrade is not possible:\n\n* Audit the Eureka registry for registrations containing non-standard field values, particularly those originating from non-.NET clients.\n* Restrict write access to the Eureka registration API to trusted services.",
  "id": "GHSA-hr73-3gpv-hh6q",
  "modified": "2026-09-17T20:30:46Z",
  "published": "2026-09-17T20:30:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-hr73-3gpv-hh6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81515"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SteeltoeOSS/Steeltoe/commit/bc1c3763aacc1fee82ef9932f338ec08dcb00432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SteeltoeOSS/security-advisories"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-j8ph-6fxj-g533"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-22391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-13T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Specific packets are being incorrectly routed to a queue used for other high-priority traffic such as BGP, PIM, ICMP, ICMPV6 ND and ISAKMP. Due to this misclassification of traffic, receipt of a high rate of these specific packets will cause delays in the processing of other traffic, leading to a Denial of Service (DoS). Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on ACX2K Series: All versions prior to 19.4R3-S9; All 20.2 versions; 20.3 versions prior to 20.3R3-S6 on ACX2K Series; 20.4 versions prior to 20.4R3-S4 on ACX2K Series; All 21.1 versions; 21.2 versions prior to 21.2R3-S3 on ACX2K Series. Note: This issues affects legacy ACX2K Series PPC-based devices. This platform reached Last Supported Version (LSV) as of the Junos OS 21.2 Release.",
  "id": "GHSA-hv3j-pf66-34pj",
  "modified": "2023-01-24T21:30:37Z",
  "published": "2023-01-13T00:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22391"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA70187"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-7849"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-22T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus.",
  "id": "GHSA-hwcg-4m94-f242",
  "modified": "2022-05-24T16:46:13Z",
  "published": "2022-05-24T16:46:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7849"
    },
    {
      "type": "WEB",
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0737"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-30T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.",
  "id": "GHSA-hwr9-p63p-wq87",
  "modified": "2022-05-13T01:36:19Z",
  "published": "2022-05-13T01:36:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7518"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/articles/3290921"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0395"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0412"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7518"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3619-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3619-2"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3754-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-3981"
    },
    {
      "type": "WEB",
      "url": "https://www.spinics.net/lists/kvm/msg151817.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2017/06/23/5"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99263"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1038782"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-30716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-07T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.",
  "id": "GHSA-hwx5-r3gc-qg42",
  "modified": "2022-06-12T00:00:47Z",
  "published": "2022-06-08T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30716"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-47100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-02T23:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \\p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.",
  "id": "GHSA-hx28-vm67-xh3r",
  "modified": "2023-12-08T18:30:37Z",
  "published": "2023-12-03T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47100"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-18T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application.",
  "id": "GHSA-j23w-523j-9593",
  "modified": "2022-07-27T00:00:34Z",
  "published": "2022-07-19T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openhwgroup/cva6/issues/900"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openhwgroup/cva6/pull/923"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-14T08:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.",
  "id": "GHSA-j293-2f59-6wr3",
  "modified": "2022-05-13T01:22:40Z",
  "published": "2022-05-13T01:22:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6256"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rgaufman/live555/issues/19"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2019/Mar/22"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202005-06"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2019/dsa-4408"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "llama-index-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-12704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755",
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T17:40:52Z",
    "nvd_published_at": "2025-03-20T10:15:29Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thread terminates abnormally before the _llm.predict is executed, there is no exception handling for this case, leading to an infinite loop in the get_response_gen function. This can be triggered by providing an input of an incorrect type, causing the thread to terminate and the process to continue running indefinitely.",
  "id": "GHSA-j3wr-m6xh-64hg",
  "modified": "2026-02-24T16:08:07Z",
  "published": "2025-03-20T12:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12704"
    },
    {
      "type": "WEB",
      "url": "https://github.com/run-llama/llama_index/commit/d1ecfb77578d089cbe66728f18f635c09aa32a05"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/run-llama/llama_index"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/a0b638fd-21c6-4ba7-b381-6ab98472a02a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LlamaIndex Improper Handling of Exceptional Conditions vulnerability"
}