CVE Vulnerability Catalog

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN configuration data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force a reboot via a crafted MQTT message.

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.

An attacker with valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, applications that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter are vulnerable. An attacker can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

In the Linux kernel's IPVS, there is an issue with propagating the one-packet flag to synced connections, which can lead to stale hash entries and use-after-free.

In the Linux kernel, the mtk_eth_soc network driver had a bug where the wrong pointer (net_device instead of mtk_eth) was passed to mtk_handle_irq_rx in mtk_poll_controller. This could cause a system crash when using CONFIG_NET_POLL_CONTROLLER.

In the Linux kernel, the idpf driver had a bug where idpf_get_reg_intr_vecs() fills the reg_vals[] array without bounding it to the actual number of allocated vectors. A reply from the controller (PF or hypervisor) with a sum of vectors exceeding the allocated count leads to an out-of-bounds write.

In the Linux kernel's KVM subsystem for s390, airq_iv_create() can return NULL, but its return value is not checked. On failure, zdev->aibv will be NULL, leading to a NULL dereference in kvm_zpci_set_airq(). The fix adds a NULL check and frees previously allocated resources.

In the Linux kernel's vxlan subsystem, after calling route_shortcircuit(), the Ethernet header pointer may point to freed memory because the function can reallocate the skb buffer. This leads to a use-after-free when reading the destination address.

A vulnerability was found in the Linux kernel's NTFS filesystem. Attribute lists for base inodes were not properly validated when resident, allowing out-of-bounds reads of the buffer. A validation function was added to check each entry's header and length before use.

In the Linux kernel's NTFS filesystem, ntfs_external_attr_find() improperly bounds-checks the next attribute-list entry, potentially leading to a slab out-of-bounds read with a crafted disk. The fix adds validation of the entry before dereferencing.

In the perf sched tool in the Linux kernel, register_pid() has several issues when processing untrusted perf.data: integer overflow, heap buffer overflow via strcpy, BUG_ON on allocation failure, and memory leak on realloc. The fix caps pid, uses strlcpy, adds NULL checks, and uses safe realloc patterns.

In the perf tool in the Linux kernel, machine__resolve() does not validate the CPU index from untrusted perf.data before accessing env->cpu array, potentially leading to an out-of-bounds heap read. The fix uses perf_env__get_cpu_topology() and adds bounds checking.