CVE Vulnerability Catalog

A vulnerability in the Linux kernel's ksmbd component (SMB/CIFS server) allows bypassing a security control that introduces a 5-second delay during session setup to prevent dictionary attacks. This bypass can be achieved through the use of asynchronous requests.

In the netavark package, a network stack for containers used with Podman, the dns.podman search domain was removed. As a result, a container may use the host's resolv.conf, and if one of the search domains contains a hostname matching the container's name, DNS queries may be forwarded to external servers.

A vulnerability was found in libssh involving an uninitialized variable in the privatekey_from_file() function. It is triggered when the specified file does not exist, potentially leading to signing failures or heap corruption.

In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

An SSRF vulnerability in JGM Pandoc v3.6.4 allows attackers to inject a crafted iframe, gaining access to and compromising the entire infrastructure. Pandoc's default behavior of fetching and parsing untrusted HTML can facilitate exploitation of this flaw.

A vulnerability in Qt's QColorTransferGenericFunction causes a denial of service when passing values outside the expected range, e.g., when processing a specially crafted ICC profile via QColorSpace::fromICCProfile. Affects Qt from 6.6.0 through 6.8.3 and from 6.9.0 through 6.9.1; fixed in 6.8.4 and 6.9.2.

A vulnerability in Sudo before version 1.9.17p1 allows listed users in the sudoers file to execute commands on unintended machines when the file specifies a host that is neither the current host nor ALL.

A logic flaw was found in the GIF parser of GdkPixbuf's LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length instead of the actual number of written bytes. This causes uninitialized buffer sections to be included in the output, potentially leaking arbitrary memory contents in the processed image.

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.

Wykryto podatność w GNU ncurses do wersji 6.5-20250322, klasyfikowaną jako problematyczną. Dotyczy ona funkcji postprocess_termcap w pliku tinfo/parse_entry.c i prowadzi do przepełnienia bufora na stosie.

A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

A flaw in the interactive shell of the xmllint XML parsing tool causes overly long commands to not be properly size-checked, potentially leading to a crash. In rare configurations without modern protections, arbitrary code execution may be possible.

W GLib występuje błąd w zarządzaniu pamięcią przez GString podczas dodawania danych do ciągów. Przy dużych ciągach, połączenie ich z dodatkowymi danymi może spowodować ukryty przepełnienie w obliczeniach rozmiaru, co prowadzi do pisania danych poza przydzieloną pamięcią.

A Use-After-Free vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module affects only HTTP/2 handling. It arises from a race condition between uploading POST request body and simultaneous handling of HTTP errors. Affects only Qt 6.9.0; fixed in Qt 6.9.1.

A vulnerability has been identified in the libarchive library, triggered when file streams are piped into bsdtar, causing an out-of-bounds read. This can lead to unpredictable program behavior, memory corruption, or denial of service.

An off-by-one vulnerability has been identified in the libarchive library when handling file name prefixes and suffixes. This flaw causes a 1-byte write overflow, potentially corrupting adjacent memory and leading to unpredictable program behavior or crashes.

An integer overflow vulnerability has been identified in the libarchive library when processing WARC files claiming more than INT64_MAX - 4 content bytes. An attacker can craft a malicious WARC archive to trigger this overflow, leading to unpredictable behavior, memory corruption, or denial of service. This affects libarchive versions prior to 3.8.0.

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior.

A security flaw in Dígitro NGC Explorer up to 3.48.21 involves an unknown function of the Password Transmission Handler, resulting in client-side enforcement of server-side security. The attack can be initiated remotely but is difficult to exploit. Upgrading to version 3.48.22 resolves the issue.