CVE Vulnerability Catalog

Slican telephone exchanges use symmetric encryption for TCP/IP communication, and the secret key is hardcoded in multiple binary files. An attacker with access to these files can decrypt the communication.

In Eclipse Jetty, across various versions of jetty-annotations and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation and web.xml defined security-constraint on the same url-pattern were not applied if the web.xml had more than one url-pattern for a servlet and a security-constraint applied to only some of those url-pattern definitions.

A weak password recovery mechanism for forgotten passwords in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators can read and write the management file, but it is protected by Windows.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash.

In Eclipse Vert.x (vertx-grpc-server module), the configurable maximum message size limit for gRPC is applied to the compressed size rather than the actual uncompressed content size. This allows an attacker to send a compressed message that expands to far more memory than the configured limit.

In the Eclipse Vert.x MySQL client (vertx-mysql-client), the column definition array is pre-allocated based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server (or a man-in-the-middle attacker) can send a crafted packet with an extremely large column count, causing a massive heap allocation.

In the Eclipse Vert.x MQTT client (vertx-mqtt), MqttClient stores every inbound QoS 2 PUBLISH message in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet. This map has no size limit, and the maxInflightQueue option only constrains the outbound path.

In the binary array decoder of the Eclipse Vert.x PostgreSQL client (vertx-pg-client, DataTypeCodec.binaryDecodeArray), a Java array is allocated based on a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server (or an on-path attacker on an unencrypted connection) can send a crafted DataRow message with an excessively large array dimension value.

In the TDS message decoder of the Eclipse Vert.x MSSQL client (vertx-mssql-client), inbound TDS packets are aggregated into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag.

In Eclipse Vert.x, the uniqueItems keyword validation (vertx-json-schema module) uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time.

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash.

In Rancher, a user with the ability to create a project on a certain cluster can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, leading to privilege escalation, because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

In Steve, by default an insecure option was used that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

In Eclipse Vert.x (vertx-http-proxy module), the body transformer interceptor relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. The vulnerability requires the use of an intercepting body transformer.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocated when decompressing frames or messages. This allows a zip bomb style denial-of-service attack.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or a man-in-the-middle attacker, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation.

In bhyve's framebuffer device model, maximum resolution constants were duplicated between the framebuffer and RFB modules and got out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

In bhyve's HDA audio device model, zero-length Buffer Descriptor List (BDL) entries were not checked when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields could also be modified by the guest after validation.