CVE Vulnerability Catalog

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist or port validation on exposed IOCTLs. Attackers can obtain a device handle and write to sensitive ports including PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, causing immediate system reset or other hardware-level manipulation from a standard user account.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address.

In DirectIo64.sys drivers in PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016, there is a privilege escalation and denial-of-service vulnerability. It allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. Attackers can exploit the unrestricted write IOCTL to zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions contains hard-coded credentials that allow local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal and computing valid MD5 authentication tags for arbitrary IOCTL write requests. Attackers can also bypass a secondary validation gate by using the driver's own bit-clear IOCTL to clear a single bit in the gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.

A vulnerability in the DirectIo64.sys kernel driver of PassMark products before specified versions is due to improper access control, as the device object is created without a security descriptor. Unprivileged local users can open a handle to the device and issue IOCTLs through the permissive default Windows ACL, gaining access to restricted hardware operations regardless of privilege or integrity level.

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.

A vulnerability in Nango before 0.71.6 is due to missing authentication in the runner tRPC server, allowing unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

In the libtpms library, which provides software TPM 2.0 emulation, when restoring TPM 2.0 state (e.g., during VM power-on or migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, bypassing a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

In jofpin trape 1.0.0, the core/stats.py file of the Login Endpoint component has a missing authentication vulnerability. The attack can be initiated remotely, and the exploit is publicly available. The project was informed but has not responded.

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

A SQL injection vulnerability in ILIAS before versions 9.22, 10.10, and 11.3 exists in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

In the Linux kernel, a vulnerability in SELinux has been fixed: every boolean value must be defined. The number of booleans (p_bools.nprim) comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array walks it by index and dereferences each entry, which can lead to issues. The fix rejects a boolean value that no boolean defines, once, where the array is built.

In the Linux kernel, the security_get_classes() function in SELinux did not validate whether a class value is defined by the policy, leaving a NULL pointer in the array, which could lead to a system crash when creating directory entries.

In the Linux kernel ASoC SOF subsystem, the error path in sof_widget_setup_unlocked() has a bug where cleanup functions are called twice on failure, leading to double decrement of use_count and double invocation of core_put.