CVE Vulnerability Catalog

In Keyfactor SignServer before 7.6.0, the output file for SignerStatusReportWorker can be set to any path, even one pointing to an existing file. This allows a user with admin access to write files in arbitrary directories and potentially overwrite files accessible by the local JBoss user.

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. An unauthenticated client can force the RAKP Message 1 handler to return early before overwriting the authentication object's defaults. The IPMI service then accepts a RAKP Message 3 with HMAC computed using a constant 20-byte 'userKey' initialized from '0penBmc' and an often-predictable 'bmcRandomNum'.

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. A logic flaw allows replacing the authorization context of an existing session with a target account while maintaining the original integrity and encryption keys, leading to privilege escalation without re-authentication.

Mitigation bypass vulnerability in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Denial-of-service vulnerability in the Security component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Denial-of-service vulnerability in the SVG component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Incorrect boundary conditions vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mitigation bypass vulnerability in the Popup Blocker component of Firefox and Thunderbird. The flaw was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

A privilege escalation vulnerability in the Enterprise Policies component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Incorrect boundary conditions vulnerability in the Safe Browsing component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Information disclosure vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Spoofing vulnerability in the DOM: Navigation component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Site isolation vulnerability in the Reader Mode component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Use-after-free vulnerability in the Widget: Gtk component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sandbox escape in the Profile Backup component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.