CVE Vulnerability Catalog

A vulnerability in the AnyConnect firewall for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should have been denied. This is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session. An attacker could exploit this by establishing an AnyConnect connection to the affected device.

A vulnerability in the AnyConnect firewall for Cisco ASA and FTD could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should have been denied. This is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session.

A vulnerability was found in PAM where secret information (e.g., passwords) is stored in memory. An attacker can send characters to the victim's standard input (stdin), training the branch predictor to speculatively execute an ROP chain. This could leak passwords, including those from /etc/shadow during authentication.

A vulnerability was found in GraphQL due to improper access controls on the introspection query. This allows unauthorized users to retrieve a comprehensive list of available queries and mutations, increasing the attack surface and facilitating discovery of flaws.

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier lacks authentication in the Boa webserver, allowing remote, unauthenticated attackers to retrieve logs containing sensitive system information.

A vulnerability in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier allows remote information disclosure. An unauthenticated attacker can send a GET request to the index page, leaking memory addresses of uClibc and the stack.

A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System versions up to 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.

In the Linux kernel, uart_shutdown() calls uart_port_dtr_rts() without checking if the uport pointer is NULL, despite an earlier NULL check being added. This can lead to a NULL pointer dereference.

A bug in the Linux kernel igb driver can cause a kernel panic after a non-fatal PCIe error. The igb_io_resume() function attempts to bring the network interface up even though it was not brought down, triggering a BUG in napi_enable().

A vulnerability was fixed in the Linux kernel's net/smc subsystem where IPPROTO_SMC sockets did not set the icsk_sync_mss pointer despite INET_PROTOSW_ICSK being set. This led to a kernel panic (NULL pointer dereference) during socket creation, e.g., triggered by security modules like Smack.

In the Linux kernel, the x86/mm/ident_map code's ident_pud_init() uses GB pages for identity maps, potentially including larger address ranges than requested, including BIOS-reserved areas. This can allow processor speculation into reserved regions, causing system halts on UV systems.

In the Linux kernel, a vulnerability was resolved in ext4: dax regarding overflowing extents beyond inode size when partially writing. If the process is killed by a signal during dax_iomap_rw(), the copied data is returned and added to the inode size, which means the length of written extents may exceed the inode size, causing fsck to fail. The fix truncates extents if the written length is smaller than expected.

In the Linux kernel, an ext4 vulnerability involves accessing an uninitialized spinlock (sbi->s_bdev_wb_lock) during the fast-commit replay path. This triggers a warning about registering a non-static key and can disrupt lock validation. The fix moves the spinlock initialization earlier in __ext4_fill_super().

W jądrze Linuxa rozwiązano podatność związaną z niewłaściwym zarządzaniem licznikami referencji na węźle CPU. W funkcji parse_perf_domain, w przypadku błędu podczas wywołania of_parse_phandle_with_args, odniesienie do węzła urządzenia CPU nie jest prawidłowo dekrementowane.

In the Linux kernel, a race condition in the exec path_noexec() check caused spurious WARN_ON warnings. The fix removes the WARN_ON while keeping the redundant check.

In the Linux kernel's amd-pstate cpufreq driver, the return value of cpufreq_cpu_get() was not checked for NULL, leading to potential NULL dereference. The fix adds the check and returns on error.

In the Linux kernel, the wifi: mwifiex driver replaces a one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext to fix a field-spanning write warning during memcpy. This error could lead to memory corruption.

In the Linux kernel, a bug in ext4_ind_migrate() concerns the unlock order of i_data_sem. This can lead to a deadlock when an EXT4_IOC_MIGRATE ioctl is issued on a file descriptor opened with O_SYNC, racing with a write(2) system call. The issue only occurs when CONFIG_PROVE_LOCKING is enabled.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: system hang while resuming with a TBT monitor. During resume, the Thunderbolt monitor HPD triggered drm_client_modeset_probe() while connector->dev->master was NULL, messing up the pipe topology. The fix skips TBT monitor HPD during resume.