CVE Vulnerability Catalog

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper certificate validation, allowing a remote attacker to impersonate the TNC policy server and modify traffic.

IBM Virtualization Management Interface versions FW1110.00-FW1110.30, FW1120.00, and FW1060.00-FW1060.80 contain a vulnerability allowing an authenticated administrator to crash the VMI. The interface restarts automatically, but repeated exploitation could cause sustained availability impact.

IBM PowerVM Hypervisor (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it.

IBM PowerVM Hypervisor (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system.

Tapo C100/C101 V5 has a heap-based buffer overflow in the RTSP service. An authenticated attacker on the local network can send crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, leading to temporary denial of service.

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot.

A flaw was found in search-v2-operator: its ClusterRole has permissions equivalent to a cluster administrator, allowing impersonation, RBAC modification, CSR approval, and ManifestWork management, leading to excessive privileges and potential privilege escalation.

Snipe-IT prior to 8.6.2 has a stored XSS vulnerability in manufacturer or supplier names. A crafted name can execute JavaScript when an authenticated user views the detail page, potentially exposing data or actions available to that session.

Snipe-IT prior to 8.6.3 allows any activated account to read maintenance records for assets in the same company without asset or maintenance permission. The show() method lacks authorization, disclosing asset tags, suppliers, purchase costs, notes, and dates.

Snipe-IT prior to 8.6.3 has a vulnerability that allows a restricted user to obtain another user's randomized EULA filename and download the signed file. The /stored-eula-file/{filename} and /account/stored-eula-file/{filename} routes do not consistently enforce ownership and target-user authorization.

Snipe-IT prior to 8.6.3 has a vulnerability that allows a company-scoped user in FMCS floater mode to access users whose company_id is null. Broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess, which can expose personal data and assigned licenses, and allow modification of profiles and soft-deletion of users.

Snipe-IT prior to 8.4.1 allows an authenticated user with generic asset edit permission to delete files attached to assets outside their ownership or company. The destroy() methods authorize against the object class instead of the instance, creating an insecure direct object reference.

Snipe-IT prior to 8.6.0 allows an authenticated user with users.create permission to assign admin permission when creating a user. The store() method strips superuser but not admin permission, allowing the created account to gain administrative privileges.

Snipe-IT prior to 8.4.1 allows a non-superadmin to submit company_id directly in the update() method of BulkAssetsController, bypassing Company::getIdForCurrentUser(). This allows assets to be moved across company boundaries, breaking multi-tenant isolation.

Snipe-IT prior to 8.5.0 allows a user who can edit other users to reset a superadmin's two-factor authentication. The postTwoFactorReset() endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled.

Snipe-IT prior to 8.6.1 allows a user with import permission to overwrite a non-admin user's email via CSV update mode and then request a password reset to take over the account. UserImporter strips unauthorized fields, but ItemImporter restores them from the raw CSV row, and the import path does not require users.edit.