CVE Vulnerability Catalog

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.

Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU.

FastGPT before version 4.15.2 has unauthorized access to WeChat (iLink) share-channel endpoints using only the public shareId. An unauthenticated attacker can hijack a victim's WeChat channel, replace bot credentials, and expose private app responses.

The Bendix EC80 brake ECU is vulnerable to a stack-based buffer overflow, potentially allowing an attacker to crash the ECU and remotely execute arbitrary code or inject CAN bus traffic. This could lead to loss of ABS, steering assist, speedometer, and shifting.

Wazuh versions 4.14.0 through 4.14.6 allow an authenticated low-privilege user to read the cluster secret from the manager configuration. This occurs because the masking logic is disabled by any update-config RBAC rule, including an explicit deny.

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network.

Ceph versions prior to 20.2.4 and 19.2.6, in the RGW SigV4 handler, do not reject requests carrying x-amz-* headers absent from the signed header set. This allows anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW honors, potentially leading to privilege escalation.

Wazuh versions 4.2.0 through 4.14.6 have multiple active response scripts that pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools running as root.

Wazuh versions 4.0.0 through 4.14.6 are vulnerable to a crash during agent enrollment when a malicious enrollment manager returns a malformed key response with fewer than four fields, causing a NULL pointer dereference. Fixed in version 4.14.7.

The ip-customblock active response script in Wazuh contains a path traversal vulnerability that allows an attacker to create or delete arbitrary files on the filesystem as root. The script does not validate the IP address in the srcip field, enabling the use of ../ sequences to escape the base directory.

Ceph before versions 20.2.4 and 19.2.6 has a flaw in the Monitor subscription handler that allows a user with only read-only capabilities (mon allow r) to read the entire configuration-key store. This store contains sensitive secrets, including LUKS disk-encryption passphrases and the cephadm SSH private key.

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers.

Ceph versions prior to 20.2.4 and 19.2.6, in RADOS Gateway (RGW), protect STS session tokens with AES-128-CBC without message authentication, allowing an attacker holding a valid STS token to tamper with it undetected and escalate to full RGW administrative access.

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.