CVE Vulnerability Catalog

An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.

In the Linux kernel, the pinctrl devicetree module had a reference count leak in pinctrl_dt_to_map() when allocation of the propname buffer failed. The fix calls pinctrl_dt_free_maps(), which drops the reference.

In the Linux kernel, nfs_net_init() ignored the error returned by rpc_proc_register(), leading to a warning when destroying an immature network namespace. The issue was resolved by properly handling this error.

In the Linux kernel, an uninit-value access vulnerability was found in __ip_make_skb(). The issue is caused by a race condition when checking the HDRINCL flag and missing initialization of fl4_icmp_type and fl4_icmp_code fields in the flowi4 structure.

In the Linux kernel, a flaw was fixed in TCP socket handling for the TCP_SYN_RECV state, where calling shutdown() could transition to TCP_FIN_WAIT1 without proper buffer initialization. This led to a divide-by-zero in tcp_rcv_space_adjust() and a kernel crash. The fix defers sending FIN until the socket transitions to TCP_ESTABLISH.

In the Linux kernel, a vulnerability was found in the __ip6_make_skb() function for IPv6, involving potential uninitialized value access. The issue arises from incorrect checking of the HDRINCL flag on the socket, which can lead to a race condition and reading uninitialized data.

A vulnerability exists in the Linux kernel where a possible NULL pointer dereference occurs in fib6_rule_action() within the ipv6 fib6_rules module. The function ip6_dst_idev() can return NULL, which is not checked before use, leading to a kernel crash (general protection fault). The vulnerability can be triggered by a local user via a specially crafted SCTP connection.

In the Linux kernel, userfaultfd did not reset write-protect bits in page tables on close(), only on explicit UFFDIO_UNREGISTER ioctl. The fix covers close() as well, resolving a WARN trace. Leftover bits may be observable but are described as harmless.

In the Linux kernel, the rtnetlink module's validation of the nested IFLA_VF_VLAN_LIST attribute size was insufficient — it checked only NLA_HDRLEN (4 bytes) instead of sizeof(struct ifla_vf_vlan_info) (14 bytes). A too-small attribute could be cast to the struct, causing an out-of-bounds read.

A command injection vulnerability was discovered in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228 in the UploadFirmwareFile function via the FileName parameter. An attacker can remotely execute arbitrary system commands.

A stack overflow vulnerability was discovered in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228. The issue occurs in the SetPortForwardRules function via the desc parameter.

A denial of service vulnerability in 389-ds-base LDAP server. An authenticated user may cause a server crash while modifying the `userPassword` attribute using malformed input.

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. These functions compile Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

A vulnerability in the Snort Intrusion Prevention System (IPS) rule engine affects multiple Cisco products and could allow an unauthenticated, remote attacker to bypass configured rules. The issue is due to incorrect HTTP packet handling.

A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to successfully establish a VPN session on an affected device. The issue is due to improper separation of authorization domains when using SAML authentication.

A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection offered by a configured ACL. The issue is due to a logic error when an ACL changes from inactive to active in the running configuration.

A vulnerability in the file policy feature used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. The issue is due to a logic error when a specific class of encrypted archive files is inspected.

In the Linux kernel, a race condition exists in the CXL subsystem between delete_endpoint() and parent port unregistration. The bug involves a missing reference on the parent device and incorrect use of port->dev instead of endpoint->dev.parent in RCH topologies, leading to use-after-free and spinlock corruption.

In the Linux kernel, a flaw in the F2FS filesystem's extent_cache handling can cause a kernel panic (null-ptr-deref) during fallocate operations on a file with the compression flag after compression is disabled. The vulnerability was fixed by splitting initial and dynamic conditions for extent_cache allocation.

W jądrze Linuxa zidentyfikowano podatność, która dotyczy funkcji fiemap. Nie blokowanie inoda w trybie współdzielonym przed rozpoczęciem fiemap może prowadzić do zakleszczenia, gdy równocześnie wykonywana jest operacja fsync na pliku, co skutkuje błędem podczas dostępu do bufora przestrzeni użytkownika.