CVE Vulnerability Catalog

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.

A vulnerability in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources to bypass security controls. The HelmRelease controller processes chart templates with elevated ServiceAccount privileges without proper validation, enabling deployment of arbitrary resources across the cluster.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.

A vulnerability in Lighthouse allows a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces. This occurs because the destination namespace is derived from an attacker-controlled label or annotation on the broker object.

A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function tests hm.proto.len with an impossible greater-than-eight condition, so is_http_1_0 is never set, and Mongoose processes chunked encoding that an HTTP/1.0 proxy can ignore.

A vulnerability in Mongoose before version 7.22 allows an on-path network attacker with a wildcard certificate for a parent domain to impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern like *.example.com can match foo.bar.example.com.

A vulnerability in Mongoose before version 7.23 allows a network attacker to impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. The mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without verifying the certificate signature.