CVE Vulnerability Catalog

In the IPv6 subsystem of the Zephyr stack (subsys/net/ip/ipv6_nbr.c), the net_ipv6_send_ns() function allocates a transmit net_pkt for a Neighbor Solicitation. When called with a data packet pending on an unresolved neighbor and the neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_object_get in src/amf.c during AMF object parsing. The manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_string_new in src/amf.c during AMF string processing. Manipulation of the length argument results in a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in dibo-software diboot 3.8.0 in an unknown part of the file /api/iam/tenant/resource in the Tenant Resource Assignment Handler component. Manipulation of the tenantId argument leads to improper access controls. The attack can be launched remotely, and the exploit has been publicly disclosed.

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.

Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled – most importantly fork pull requests on public repositories – a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner.

A vulnerability in Zephyr RTOS causes network buffer (net_pkt) leaks when Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE). Frames with unrecognized EtherType that are also delivered to the local stack are marked as NET_OK, which is interpreted as consumed, but they are never freed. An attacker on the L2 segment can flood broadcast/multicast frames with arbitrary EtherType, exhausting the RX buffer pool and causing a persistent denial of service until reboot.

The LwM2M JSON content formatter's get_string() function has an out-of-bounds write vulnerability (CWE-787). The length check uses 'string_length > buflen', which accepts a string whose length exactly equals the buffer size, then writes a NUL byte one past the end after memcpy. An attacker can trigger a one-byte overflow, potentially corrupting adjacent memory.

A vulnerability in the I3C IBI subsystem of the Linux kernel (drivers/i3c/i3c_ibi_workq.c) stems from missing synchronization on the free-list of work nodes (sys_slist_t). Allocation and deallocation helpers are called from interrupt context (ISR) and the workqueue thread without locks, leading to a race condition. An attacker with physical access to the I3C bus can trigger a series of interrupts, causing list corruption, double allocation, or out-of-bounds writes.

A malicious virtual function can invoke certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution.

A vulnerability was found in dibo-software diboot 3.8.0 in some unknown functionality of the file /admin/ in the Tenant Administrator Management API component. Manipulation of the tenantId argument results in improper access controls. The attack may be initiated remotely, and the exploit has been made public.

A vulnerability has been found in dibo-software diboot 3.8.0 in an unknown functionality of the file /api/ai-session/ in the AI Session Endpoint component. Such manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been disclosed to the public.

A flaw has been found in MegaEase EaseProbe up to 2.3.0. The function realIP in web/server.go of the Middleware component is affected. Manipulation of X-Forwarded-For/X-Real-IP/True-Client-IP arguments causes improper access controls. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was detected in the TubeBuddy for YouTube Extension up to version 5.8.4 on Chrome. It affects the TBGlobal.GetToken function in tubebuddymaster1.js, where manipulation of arguments t/c/r results in insufficient verification of data authenticity. The attack can be launched remotely, and the exploit is now public.