CVE Vulnerability Catalog

hexpm (hex.pm) has a vulnerability of insufficient session expiration in OAuth tokens. A user whose organization membership or session has ended can still read the organization's private packages and documentation via a retained refresh token. Access is read-only and limited to organizations the account belonged to when the token was granted.

Twenty is an open-source CRM platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy.

In radare2 prior to 6.2.0, the Windows 64-bit crash-dump (dmp64) parser was vulnerable because it used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size, causing denial of service through excessive memory consumption and processing time.

In radare2 prior to 6.2.0, the NE relocation fixup-chain parser was vulnerable because it followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration, causing denial of service through continuous CPU and memory consumption.

radare2 before version 6.2.0 has a vulnerability in the Mach-O LC_DATA_IN_CODE parser that trusts dataoff and datasize, potentially leading to a heap out-of-bounds read when processing a crafted file. The attack requires the bin.verbose option to be enabled. It may cause process termination, but no memory disclosure has been demonstrated.

radare2 before version 6.2.0 has a vulnerability in the Lua 5.3 bytecode function parser that reads fixed metadata fields without checking remaining buffer length. When opening a crafted file with a function name ending at the buffer boundary, the parser reads beyond allocated memory, possibly causing incorrect results or process termination.

radare2 before version 6.2.0 has a vulnerability in the binary property-list Unicode parser that underallocates memory and does not guarantee NUL termination. Running pFB or pFBj commands on untrusted data can cause out-of-bounds reads, leading to disclosure of uninitialized or adjacent heap contents in JSON output or process termination.

radare2 before version 6.2.0 has a vulnerability in the Mach-O Swift field-metadata parser where a relative pointer can be lower than the section base, leading to a negative index. When parsing metadata from a crafted file, the parser reads four bytes before the buffer, possibly causing incorrect processing or process termination.

In radare2 prior to 6.2.0, the Apple Preferred Executable Format (PEF) loader was vulnerable because it accepted relocSecCount values not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file, causing denial of service through excessive CPU consumption and prolonged processing.

In radare2 prior to 6.2.0, ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array, causing a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated.

In radare2 prior to 6.2.0, the CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation, causing heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated.

Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint. An authenticated attacker can write arbitrary data to any location on the device's filesystem, leading to remote code execution.

Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint. An unauthenticated attacker can read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution.

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set script schedule' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set nfs download' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the Telnet connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the SSH connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd builds its SSH connection target using snprintf with user-supplied input; supplying an overlong username truncates the device IP suffix and redirects the connection to an arbitrary host. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow. An authenticated attacker can potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call.