CVE Vulnerability Catalog

In FlexRIC v2.0.0, an authorization bypass vulnerability exists in the iApp's xApp isolation mechanism. The function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id.

OpenAirInterface5G 2.4.0 (nr-softmodem) has a vulnerability in PRB utilization calculation in E2SM-KPM functions. Division by zero when two consecutive total_prb_aggregate samples are identical causes SIGFPE and crashes the nr-softmodem process, leading to 5G service interruption for all connected UEs. No authentication is required.

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a non-existent ran_func_id. Debug builds assert (SIGABRT), Release builds NULL pointer dereference (SIGSEGV). A remote unauthenticated attacker can send a crafted message to port 36421.

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence over SCTP to crash the process via SIGABRT.

FlexRIC v2.0.0 has a reachable assertion in e2ap_recv_sctp_msg(). Sending a single SCTP message with payload >= 32768 bytes crashes near-RT RIC, iApp, E2 Agent, or xApp via SIGABRT. Release builds suffer integer overflow.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup returns NULL, causing assert (SIGABRT) in Debug or dereference (SIGSEGV) in Release. A remote unauthenticated attacker can send a request to port 36422.

A missing authentication vulnerability was found in claw-orchestrator up to version 3.5.5 in the EmbeddedServer function in the file src/embedded-server.ts of the API Endpoint component. The attack can be performed remotely, and the exploit is publicly available.

The mcpilot tool version 0.1.0 by horizon921 is vulnerable to server-side request forgery (SSRF) in the MCP API Call endpoint. Manipulation of the serverBaseUrl argument allows a remote attacker to send requests to internal network resources.

In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.

The Windows kernel driver PCTCore64.sys from PC Tools Internet Security has improper access control, allowing user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker can exploit this to perform sensitive operations on the system.

In the Linux kernel, a vulnerability in the SMB client was fixed that allowed userspace to create cifs.spnego keys with authority-bearing fields (such as pid, uid, creduid, upcall_target) via request_key(2) or add_key(2). Now only kernel-originating descriptions are accepted.

Nextcloud (an open source content collaboration platform) versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0 have a missing signature verification in User OIDC, allowing a malicious ID4me authority to impersonate any user.

GiveWP WordPress plugin is vulnerable to DOM-Based XSS due to improper input neutralization during page generation. Affects versions up to 4.14.5.

The WP Document Revisions plugin for WordPress lacks authorization, allowing exploitation of incorrectly configured access control security levels. Affects versions before 4.0.0.

Missing Authorization vulnerability in Themefic Hydra Booking up to version 1.1.41. It allows exploiting incorrectly configured access control security levels.

The Advanced Access Manager (AAM) plugin for WordPress up to version 7.1.0 has an authentication bypass vulnerability via URL encoding spoofing. An attacker can bypass authentication mechanisms.

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data.

ESA AnomalyMatch before version 1.3.1 loads model files from session directories using torch.load() with unrestricted deserialization. Attackers can execute arbitrary code via crafted model checkpoint files.