CVE Vulnerability Catalog

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

NVIDIA DALI contains a vulnerability in a component that allows an attacker to cause improper index validation. Successful exploitation could lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA DALI contains a heap-based buffer overflow vulnerability. An attacker could exploit this to achieve code execution, data tampering, denial of service, or information disclosure.

Omnissa Workspace ONE Assist for macOS contains a local privilege escalation vulnerability.

Insufficient input validation vulnerability in NETGEAR JR6150 router allows users connected to local WiFi to execute operating system commands. The router reached end-of-support in 2018 with no further security updates planned.

An information disclosure vulnerability in NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a network-connected user to gain administrator access to the Orbi router.

Mem0 versions up to 0.2.8 have a missing authorization vulnerability in the POST /configure endpoint. Any authenticated user with an API key can change global LLM and embedder configuration, redirecting all traffic to an attacker-controlled server. The malicious configuration persists in PostgreSQL and survives server restarts.

A local privilege escalation vulnerability in Waves Central for macOS versions 13.0.9 through 16.5.5 exists in the privileged helper service. An attacker can exploit a race condition in PID validation to execute code as root. Fixed in version 16.6.2.

Waves Central for macOS versions 13.0.9 through 16.5.5 has a local privilege escalation vulnerability. A trusted XPC client component is signed with entitlements allowing dynamic library injection, enabling a local attacker to execute arbitrary code as root.

Ivanti EPMM before versions 12.9.0.1, 12.8.0.3, and 12.7.0.2 has an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands as root.

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name, the argument string is concatenated with the command and passed to child_process.spawn with the shell: true option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host.

In the Linux kernel, the rockchip rkcif media driver fixed off-by-one errors that could cause out-of-bounds array access.

In the Linux kernel's 9p filesystem, a vulnerability was found where access mode flags are ORed instead of replaced. When mounting with 'access=user', both V9FS_ACCESS_CLIENT and V9FS_ACCESS_USER flags are set, preventing proper operation of privileged commands like chown.

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can read, write, or delete arbitrary files on the user's system. The vulnerability was confirmed in version v0.10.15, status of other versions is unknown.

In the Linux kernel, the greybus gb-beagleplay driver has a buffer overflow vulnerability in cc1352_bootloader_rx() due to missing bounds check before memcpy, which could lead to buffer overflow and potential code execution.

In the Linux kernel, TCP ULP support for SMC was reverted because the implementation violated VFS invariants, creating a risk of use-after-free and system instability.

In the Linux kernel, the AppArmor module fixed rlimit handling for POSIX CPU timers by conditionally updating the timers.

In the Linux kernel's device mapper, a vulnerability was found in the dm_blk_report_zones function, which checks the device's suspended state without holding a lock. The device could be suspended right after the check, leading to a race condition.

In the Linux kernel, in the MPRLS0025PA pressure driver (iio: pressure), the spi_transfer struct was not zeroed before use. This can lead to unpredictable behavior or errors during SPI communication.

In the Linux kernel, the netfilter nf_tables subsystem functions nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks did not use list_del_rcu() when removing elements from the netlink hooks list. Since this list can be concurrently traversed by dumpers, the lack of RCU synchronization could lead to a data race.