CVE Vulnerability Catalog

In Zephyr's kernel pipe implementation, the syscall verifier z_vrfy_k_pipe_init() uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing an unprivileged thread to re-initialize an already-in-use pipe. Re-initialization resets buffers and wait queues without waking blocked threads, leaving them orphaned and corrupting kernel structures.

In Xtensa systems with MPU and userspace enabled, arch_buffer_validate() defaulted to 0 (access permitted), allowing validation bypass when the rounded buffer extent wraps the 32-bit address space. An unprivileged user thread could pass crafted (addr, size) to any syscall validating user buffers, gaining access to kernel or other-partition memory.

A stack-based buffer overflow vulnerability has been detected in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSafeMacFilter function of the /goform/SafeMacFilter file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution. The exploit has been publicly disclosed.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. Improper validation of user-supplied data can result in an out-of-bounds write.

A memory corruption vulnerability exists in Arena® Simulation within the linker.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write.

A memory corruption vulnerability in Arena® Simulation's expmt.exe (Siman) component due to improper validation of user-supplied data leads to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the current process context by tricking a user into opening a malicious file.

A memory corruption vulnerability exists in Arena® Simulation within the model.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

An improper privilege management vulnerability has been discovered in Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. This flaw could allow an attacker to escalate privileges on the system.

A stack-based buffer overflow vulnerability has been identified in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Manipulating the page argument allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.

A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro router version 16.03.66.23, specifically in the fromSafeClientFilter function of the /goform/SafeClientFilter file. An attacker can remotely manipulate the page argument to trigger the overflow. The exploit has been publicly released and may be used in attacks.

A vulnerability in the Sesame Time web application and its REST v3 API allows session impersonation due to insufficient access control. The system uses the session identifier (USID) as the sole validation mechanism without verifying its ownership, and does not revoke old sessions upon new logins. An attacker with a valid USID can impersonate a victim and access confidential data including emails, user IDs, roles, and corporate information.

A vulnerability in SIMATIC S7-PLCSIM Advanced (all versions) involves improper handling of high-volume multicast traffic, leading to memory exhaustion. An unauthenticated attacker on the local network segment can cause a denial-of-service (DoS) condition, making the application inaccessible until a manual restart. The attack requires a specific project configuration to be active on the target instance.

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The Web Console and REST API components use this header for audit context initialization, and Jetty's ForwardedRequestCustomizer is unconditionally installed, allowing an attacker to control the logged IP address.

A vulnerability in the Mint library for Elixir allows a remote HTTP server to exhaust client memory and cause a denial of service (DoS). The HTTP header decoding functions accumulate headers without limits, and the parser has no cap on the number or size of headers, enabling an attacker to stream infinite header lines without a terminating blank line.

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

In versions up to 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate the Domain attribute of a Set-Cookie header, violating RFC 6265. An attacker can inject a cookie for an arbitrary domain, which is stored and later transmitted to the targeted domain.

In Eclipse Vert.x up to versions 4.5.29 (4.x) and 5.1.4 (5.x), the DefaultRedirectHandler (vertx-core) forwards all request headers, including credential headers (Authorization, Cookie, Proxy-Authorization) and custom headers (e.g., X-API-Token), during cross-origin HTTP 30x redirects. No origin comparison (scheme, host, port) is performed before copying headers to the redirect target.

In Eclipse Jetty, the first HTTP/1.1 request with trailers causes the server to retain those trailers for subsequent requests on the same connection. Subsequent requests without trailers report the trailers from the first request, while requests with their own trailers report the union of the first and current request's trailers.

A vulnerability in Apache HTTP Server causes a buffer leak for requests with a body when reading the body may result in reading 0 bytes. This is particularly the case for 100-Continue requests, but also for any request with slow network connections.

An improper link resolution before file access vulnerability in the File Shredder module of Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate privileges via a race condition using symbolic links.