CVE Vulnerability Catalog

Wersja 1.2.0 i wcześniejsze NanoClaw zawierają podatność na naruszenie granicy systemu plików hosta/kontenera w obsłudze załączników wychodzących oraz czyszczeniu skrzynki wychodzącej. Umożliwia to złośliwemu kontenerowi odczyt plików poza zamierzonym katalogiem skrzynki wychodzącej.

gopls by default communicates via pipe, but supports -port and -listen flags for debugging. Using -listen without an explicit host or using -port causes gopls to listen on 0.0.0.0, potentially exposing the service unintentionally.

A SQL injection vulnerability in the `FilterEngine.create_sqla_query()` method allows authenticated Rucio users to execute arbitrary SQL against the backend database through the DID search endpoint. In Oracle deployments, attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()`, bypassing parameterization.

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, potentially leading to server crashes, out-of-memory exceptions, or excessive CPU usage.

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

A vulnerability in the SNMP protocol in Cisco 350 and 350X switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to improper error handling when parsing response data for a specific SNMP request.

A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router. This is due to improper error handling. An attacker could exploit this by submitting crafted input, causing the router to reload and resulting in a DoS.

A vulnerability in the web UI of Cisco Unity Connection Web Inbox allows an unauthenticated, remote attacker to conduct SSRF attacks. It is due to improper input validation for specific HTTP requests.

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The issue is due to insufficient validation of user-supplied input.

Uncontrolled search path element vulnerability in WatchGuard Agent on Windows allows using malicious files.

Use of hard-coded cryptographic key vulnerability in WatchGuard Agent on Windows allows inclusion of code in existing process.

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic.

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\SYSTEM.

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling due to improper header precedence.

A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. The issue occurs when processing SVG marker references, where the renderer does not verify the node type before casting.

W jądrze systemu Linux zidentyfikowano podatność, która pozwala na dostęp poza granice w funkcji fw_mbox_index_xlate(). Problem występuje, gdy w drzewie urządzeń zdefiniowano `#mbox-cells = <0>;`, co może prowadzić do niekontrolowanego dostępu, jeśli nie są dostarczone wskaźniki funkcji `fw_xlate` i `of_xlate`.

In the Linux kernel drm/xe driver, xe_pat_index_get_coh_mode() performs an array access on xe->pat.table without bounds validation when a user supplies a bogus pat_index value via the madvise IOCTL. The validation in madvise_args_are_sane() calls this function without first checking whether pat_index is within [0, xe->pat.n_entries).

In the Linux kernel ALSA usb-audio subsystem, a sanity check for the transfer buffer size was missing when silencing playback URB packets in implicit fb mode. When the capture stream setup differs from the playback stream, this can lead to out-of-bounds writes and a kernel crash.

In the Linux kernel device-mapper subsystem, stale rq->bio values cause double-initialization of cloned bios in request-based targets, leading to use-after-free and double-free scenarios, e.g. when using dm-multipath on top of a PCIe NVMe namespace.

In the Linux kernel, the mana network driver (Microsoft Azure NIC) has a use-after-free bug on the PCI rescan path. When mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan(), causing destroy_workqueue to be called twice on the already-freed gc->service_wq. The fix adds a NULL check and sets the pointer to NULL after destruction.