CVE Vulnerability Catalog

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system.

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.

Trend Micro Apex One has a link following vulnerability in the scan engine that could allow a local attacker to escalate privileges. The attacker must first have the ability to execute low-privileged code.

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu through 21052026. The vendor did not respond.

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass.

Apache Camel K has a vulnerability involving an externally controlled reference to a resource in another sphere and authorization bypass through a user-controlled key. Authorized users in a Kubernetes namespace can create a Build resource, controlling Pod generation in a namespace of their choice, including the operator namespace.

In the Linux kernel's net/rds subsystem, there is an issue with zerocopy send cleanup before the message is queued. Incorrect zerocopy state discrimination can lead to improper cleanup of user pages.

In the Linux kernel, the remove_waiter() function in rtmutex uses current instead of waiter::task, causing issues during proxy-lock rollback in rt_mutex_start_proxy_lock() called from futex_requeue(). This leads to missing pi_lock, uncleared pi_blocked_on state (UAF risk), and incorrect rt_mutex_adjust_prio_chain() behavior.

In the Linux kernel, a vulnerability in the accel/ivpu driver is fixed by preventing re-exporting of imported GEM objects. Re-exporting causes loss of buffer flags settings, leading to incorrect device access and data corruption.

In the Linux kernel's fbdev udlfb driver, vm_ops are added to dlfb_ops_mmap to prevent use-after-free. Lack of vm_ops allowed stale memory mappings after buffer replacement, leading to access to freed pages.

In the Linux kernel, in the WWAN t7xx driver, the t7xx_port_enum_msg_handler() function uses the modem-supplied port_count field as a loop bound without checking that the message buffer contains sufficient data. Sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Appropriate size checks have been added.

In the Linux kernel, in the RDS stack, when iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), pages are released but rm->data.op_nents is not reset. Later, rds_message_purge() iterates over the incorrect non-zero op_nents and frees them again, leading to a double free.

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.

The ptrace(PT_SC_REMOTE) function fails to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls, allowing a user with debugging capabilities to trigger arbitrary code execution in the kernel, even if the target process has no special privileges. This missing validation enables an unprivileged local user to escalate privileges and potentially gain full control of the system.

In the FreeBSD kernel, a file descriptor can be closed while a thread is blocked in poll(2) or select(2). The kernel fails to unlink blocked threads before freeing the object, leading to a use-after-free vulnerability. An unprivileged local user can exploit this to gain superuser privileges.

Insufficient validation of Autoprimary SOA queries has been detected, which may lead to incorrect DNS service behavior.

The libcasper(3) library does not verify that the socket descriptor fits within the FD_SETSIZE (1024) limit for select(2). An attacker can cause large file descriptors to be allocated, leading to stack corruption.

A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Gmission Web Fax versions 3.0 before 3.1 contain an unrestricted upload of dangerous file types and improper input validation vulnerability, allowing remote code execution.

Mattermost versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, and 10.11.x through 10.11.14 fail to properly validate integration URLs for path traversal. This allows a malicious authenticated user to call arbitrary APIs using the system admin's Mattermost auth token via path traversal in the integration action URL.