CVE Vulnerability Catalog

A vulnerability in the ATT layer of the Bluetooth stack in Zephyr OS leads to a use-after-free of channel memory. When a remote device disconnects during ongoing ATT traffic, a deferred callback may reference a freed channel, causing a system crash or potential memory corruption.

Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing access to functionality not properly constrained by ACLs.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Vulnerability in Koha's reports/catalogue_stats.pl where dynamic SQL is built by interpolating user-controlled Line and Column parameters directly into identifier positions of the query without whitelist validation.

Vulnerability in Koha's reports/acquisitions_stats.pl where the per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE fragments covering multiple fields.

Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where UASC server transport handlers fail to release retained partial message chunks on disconnect, allowing a remote unauthenticated client to exhaust pooled direct memory and potentially terminate the server.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability in the Call service that dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or low-privileged client to execute a denied method by batching it with an allowed method.

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability where OpcUaServerConfig.copy() fails to preserve a configured RoleMapper, leading to skipped role-permission checks and allowing an anonymous client to access protected data and operations.

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows removing important client functionality.

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow in fbxsdk::ExtractDrive, allowing arbitrary code execution in the context of the current process.

A maliciously crafted FBX file parsed through Autodesk FBX SDK can trigger a stack-based buffer overflow in fbxsdk::FbxIO::BinaryReadSectionHeader.

HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. has a Session Hijacking vulnerability due to use of GET request method with sensitive query strings. Affects versions from 26.0 before 26.1.

The freo2 product by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges may upload an executable file and execute arbitrary OS commands.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI, any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legitimate library, the malicious code is loaded and executed under the security privileges of the GV-ASManager process.

In the Linux kernel's rhashtable library, there is a use-after-free vulnerability during table restart. When the table is freed during resize, the iterator does not clear iter->p, leading to a dereference of freed memory in rhashtable_walk_next(). This affects netlink_diag and TIPC.