CVE Vulnerability Catalog

In Sandboxie-Plus 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler has a stack buffer overflow due to memcpy without length check. A local attacker can achieve code execution as SYSTEM.

Sandboxie-Plus versions 1.17.2 and earlier have two vulnerabilities in the SbieSvc service: uninitialized stack memory leak and stack buffer overflow. Chained, they allow sandbox escape and SYSTEM privilege escalation. Fixed in version 1.17.3.

Sandboxie-Plus versions 1.17.2 and earlier have an INI injection vulnerability. Any standard local user can bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters. An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation.

Twenty (open source CRM) versions 1.18.0 and earlier have an SSRF vulnerability where protection in SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js normalizes such addresses to compressed hex form, but the isPrivateIp function only recognizes dotted-decimal notation.

CoreDNS versions prior to 1.14.3 have a vulnerability in the transfer plugin that can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

SQLBot version 1.7.0 and earlier is vulnerable to prompt injection in the Text2SQL interface, where the user question parameter is directly concatenated into the LLM prompt and the extracted SQL is executed without validation, potentially leading to remote code execution via COPY FROM PROGRAM in PostgreSQL.

CoreDNS before version 1.14.3 allows TSIG authentication bypass on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, gRPC). The tsig plugin trusts the transport writer's TsigStatus(), which always returns nil for DoH/DoH3/DoQ/gRPC and does not set TsigSecret for DoT. This lets an unauthenticated client access resources protected by a tsig require all policy.

CoreDNS versions prior to 1.14.3 have a vulnerability that allows oversized dns= query parameter values in DoH GET requests, leading to expensive processing before rejecting the request. This issue has been fixed in version 1.14.3.

CoreDNS versions prior to 1.14.3 have a vulnerability that allows a remote client to cause unbounded goroutine and memory growth by opening many QUIC streams and sending only 1 byte per stream. This issue has been fixed in version 1.14.3.

Bitcoin Core through version 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.

Vulnerability in D-Link DI-8100 router version 16.07.26A1. The tggl_asp function in /tggl.asp is vulnerable to buffer overflow via manipulation of the Name argument. The attack can be carried out remotely.

A vulnerability in OpenStack Ironic before version 35.0.1 allows a user invoking 'molds' during import to request authorization to be sent to a remote endpoint. The forwarded credentials include a time-limited Keystone token (providing access to all OpenStack services Ironic is authorized for) or basic credentials configured for molds storage.

ModSecurity is an open source web application firewall engine that includes the libmodsecurity component. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character, potentially leading to worker process crashes and denial of service.

A vulnerability was found in D-Link DI-8100 version 16.07.26A1. The sprintf function in the yyxz.asp file is prone to a stack-based buffer overflow via the ID argument. The attack can be performed remotely and a public exploit exists.

RedisBloom is a probabilistic data structures module for Redis. In versions before 2.8.20, the module does not properly validate serialized values processed through the RESTORE command, which may lead to remote code execution.

RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14, the module does not properly validate serialized values processed through the RESTORE command, which may lead to invalid memory access and potential remote code execution.

A vulnerability in Redis up to version 8.6.3 allows an authenticated attacker to execute remote code via crafted data in the RESTORE command due to improper validation of serialized values.

Redis with Lua scripting enabled contains a use-after-free vulnerability in the master-replica synchronization mechanism. An authenticated attacker can exploit replicas with replica-read-only disabled to achieve remote code execution.

A use-after-free vulnerability in Redis-server versions 7.2.0 through 8.6.3 occurs when an error return from `processCommandAndResetClient` is not handled during blocked command re-execution. An authenticated attacker can exploit this to achieve remote code execution.

A command injection vulnerability was found in a hidden console command of Crestron devices. Passing control characters to the second argument causes the command to be passed to the popen function without proper sanitization. Attackers with authenticated SSH console access can execute underlying OS commands.