CVE Vulnerability Catalog

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier. An attacker can exploit an untrusted backend.

Software run by a non-privileged user can perform improper GPU system calls, causing mismanagement of a mapping state for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.

Software running as a non-privileged user can perform improper GPU system calls to corrupt kernel heap memory. By creating specific resources and parameters, an attacker can corrupt kernel memory.

Vulnerability in Tenda AC18 version 15.03.05.05: stack-based buffer overflow in function sub_45304 of file /goform/getRebootStatus (Web Management Interface component). An attacker can remotely trigger overflow via the callback argument. Exploit is publicly available.

Vulnerability in Tenda W20E version 15.11.0.6: stack-based buffer overflow in function modifyWifiFilterRules of file /goform/modifyWifiFilterRules (Web Management Interface component). An attacker can remotely trigger overflow via the wifiFilterListRemark argument. Exploit is publicly available.

A stack-based buffer overflow vulnerability has been found in Tenda W20E version 15.11.0.6 in the formPortalAuth function of the /goform/PortalAuth file. Manipulation of the gotoUrl argument can lead to buffer overflow. The attack can be launched remotely and the exploit is publicly available.

A stack-based buffer overflow vulnerability has been detected in Tenda W20E version 15.11.0.6 in the formSetPortMirror function of the /goform/setPortMirror file. Manipulation of the portMirrorMirroredPorts argument leads to buffer overflow. The attack can be initiated remotely and the exploit is public.

Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. The handle_inform/8 function does not check if the client sent an Upgrade or Connection: upgrade header in the request. After receiving a 101 response, gun switches to raw mode with no flow control, and the server can flood the client with arbitrary data, leading to memory exhaustion and VM crash.

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. The handle/5 function accumulates TCP data in the connection's buffer without an upper limit when the expected terminator (e.g., \r\n\r\n) never arrives. A malicious server can send a partial response that never completes, causing continuous buffer growth and memory exhaustion of the BEAM node.

The gun library (gun_http2 module) versions 2.0.0 to 2.4.0 have an origin validation vulnerability. An unvalidated :authority header in PUSH_PROMISE frames allows cookie injection for arbitrary third-party domains, enabling session fixation and account takeover.

In the Tenda AC1206 router with firmware version v15.03.06.23, multiple stack overflows exist in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.

Buffer overflow vulnerability in the strcpy function in /goform/formConfigDnsFilterGlobal on UTT HiPER 2610G up to version 3.0.0-171107. Manipulating the GroupName argument can lead to buffer overflow.

A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication.

A vulnerability in `cordova-plugin-inappbrowser` for iOS allows any web content loaded in the InAppBrowser to fire any pending Cordova callback in the host app. An attacker can post a message with an `id` field containing a guessable callback identifier, enabling spoofing of plugin results such as Camera, Contacts, File, or Geolocation.

A stack-based buffer overflow vulnerability has been detected in Tenda CX12L version 16.03.53.12 in the setSchedWifi function of the /goform/openSchedWifi file. Manipulation of the schedStartTime/schedEndTime arguments leads to buffer overflow. The attack can be launched remotely and the exploit is public.

This vulnerability in Bagisto is due to improper input validation in the ImageCacheController component. An unauthenticated remote attacker can exploit it by sending crafted path traversal sequences via the filename parameter to access arbitrary files outside the intended directory.