CVE Vulnerability Catalog

A SQL injection vulnerability in Security Center allows an authenticated administrator to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data, including credentials.

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.

A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.

A use-after-free vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. This allows k_work_cancel_delayable_sync() and k_work_flush_delayable() to return without blocking, and freeing the object leads to a use-after-free read and write.

The vulnerability in Zephyr RTOS concerns the system-call verifier z_vrfy_z_log_msg_static_create(), which did not validate arguments passed to the kernel function. This allows an unprivileged user thread to supply arbitrary pointers and lengths, leading to kernel memory reads and system crashes.

The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.

CKAN MCP Server before 0.4.112 contains a vulnerability in canonicalizeParams in src/utils/cache.ts that serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide. An attacker can prime a shared cache with a response for a victim's distinct query.

CKAN MCP Server before 0.4.112 contains a vulnerability in the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts. The isValidMqaServer function validates the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further information.

CrateDB before versions 6.2.8 and 6.3.2 has a vulnerability that allows any authenticated user to read, delete, or add arbitrary blobs in any blob table, regardless of grants. The issue affects the HTTP API path, which does not check privileges via AccessControl, unlike the SQL path.

The Cortex MCP server (neuro-cortex-memory) before version 3.17.1 treats the CLAUDE_PROJECT_DIR environment variable as a trusted Cortex source. An attacker can place marker files in a malicious repository, leading to arbitrary code execution via the open_visualization tool.

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker can craft and send a user a URL that redirects the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user credentials.

crun before version 1.28 contains a vulnerability in the default device setup that opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates default device nodes and stdio symlinks at the symlink target outside the container rootfs. This can lead to overwriting existing files, such as ptmx.

kas is a setup tool for bitbake based projects. In versions from 4.8 to before 5.3, kas checks out and processes repositories and configuration includes prior to validating signatures of those repositories. Under very specific conditions, this may allow an attacker to replace the original repository with one under their control.

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to verify repository integrity, users may be tricked into checking out a branch of the same name from a compromised repository. This primarily affects SHA-256 commit IDs, as SHA-1 may be vulnerable to hash collisions.

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

compliance-trestle before versions 3.12.2 and 4.0.3 has a Server-Side Template Injection (SSTI) vulnerability in the 'trestle author jinja' command. Recursive template processing allows an attacker to execute arbitrary commands by injecting malicious data into data fields.

compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.

TOTOLINK A800R version 4.1.2cu.5137_B20200730 has a stack-based buffer overflow vulnerability in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi (component lan.so). Manipulation of the Comment argument can lead to remote code execution.