CVE Vulnerability Catalog

Local privilege escalation vulnerability in the ansible.posix authorized_key module. The keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW, allowing an unprivileged user to replace symbolic links and take over system files.

A buffer overflow vulnerability in File Station 5. A remote attacker with a user account can exploit this vulnerability to modify memory or crash processes. The vulnerability has been fixed in File Station 5 version 5.5.6.5208 and later.

A missing authorization vulnerability in QuMagie allows remote attackers to access unauthorized data or perform unauthorized actions. The issue is fixed in version 2.9.0.

An incorrect authorization vulnerability in File Station 6 allows a remote attacker who gains a user account to bypass intended access restrictions. The issue is fixed in File Station 5 version 5.5.6.5243 and later.

A command injection vulnerability has been reported in several QNAP operating system versions. A remote attacker with an administrator account can exploit it to execute arbitrary commands. The issue has been fixed in newer QTS and QuTS hero versions.

NULL pointer dereference vulnerability in QNAP operating systems. A remote attacker with an administrator account can exploit this to cause a denial-of-service (DoS) attack.

A command injection vulnerability has been reported in several QNAP operating system versions. A remote attacker with an administrator account can exploit it to execute arbitrary commands. The issue has been fixed in newer QTS and QuTS hero versions.

A NULL pointer dereference vulnerability has been found in QNAP operating systems (QTS and QuTS hero). A remote attacker can exploit this vulnerability to launch a denial-of-service (DoS) attack.

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. The issue has been fixed in versions: QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, QuTS hero h6.0.0.3397 build 20260206 and later.

A command injection vulnerability in QNAP operating systems. A remote attacker with an administrator account can execute arbitrary commands.

A command injection vulnerability in QNAP operating systems. A remote attacker with an administrator account can execute arbitrary commands.

A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud, and QuTS hero. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A CSRF vulnerability in Notification Center allows remote attackers to exploit it to gain privileges or hijack user identities. The vulnerability has been fixed in Notification Center version 1.10.0.3291 and later.

Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.

In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.

In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.

Multiple stack-based buffer overflows in the SimpleBLE library for Bluetooth Low Energy. Vulnerabilities exist in the Protocol::simpleble_write function and during processing of manufacturer and service data in BLE advertisements.

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.

A remote, unauthenticated denial-of-service vulnerability in Nimiq prior to version 1.5.0 allows any state-sync peer to crash any node performing state synchronization via MerkleRadixTrie::put_chunk.