CVE Vulnerability Catalog

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, where the fix for XSA-437 introduced a calculation that may underflow, resulting in a loop that would take excessively long, potentially crashing the hypervisor, especially on 64-bit Arm.

A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to trigger an out-of-bounds memory read.

A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.

CvFWD contained a null pointer dereference affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an out-of-bounds write affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an integer overflow affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CVFS contained an XML external entity (XXE) reference handling issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The keys are shipped constants, not per-unit values, and are not rotated by the Administrator password reset, so they survive account provisioning.

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

HyperScale contained a path traversal issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

A denial-of-service security issue exists in the affected product and version. The issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.