CVE Vulnerability Catalog

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as OS commands by the SNMP alerter service, which runs with root privileges.

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a vulnerability that allows a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.

When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.

In the `_nx_secure_x509_asn1_tlv_block_parse()` function in NetX Secure, there is an out-of-bounds read. The function reads the ASN.1 tag byte before checking that the buffer holds at least one byte, causing a one-byte over-read when the remaining length is zero. This affects parsing of X.509 certificates supplied by a remote peer during the TLS handshake.

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.

The `_nx_snmp_utility_object_id_get` function in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. The OOB bytes are decoded as OID component values and written into the agent's internal OID string buffer, corrupting agent state. On systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. On bare metal embedded systems without memory protection the read silently succeeds and corrupts the agent's internal state with heap data.

An unauthenticated client can drain the RTSP server's packet pool with a few dozen requests carrying a Session header that the parser cannot convert. The Session branch returns a raw NetX error code instead of an RTSP status code, causing a response packet leak. After 26 requests the pool is exhausted and the server stops serving anyone.

Heap-buffer-overflow vulnerability in the NX mDNS module. Any host on the LAN can send two mDNS records and cause the responder to write past the end of its transmit packet. The flaw stems from comparing the rounded slot size instead of the actual string length when looking up stored names.

The `_nx_icmpv6_validate_options()` function in the Eclipse ThreadX (NetX Duo) network stack scans the ICMPv6 option area with `while (length > 2)`, leaving a one- or two-byte tail unexamined and returning `NX_SUCCESS`. Consumers then re-walk the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. This yields three outcomes: an infinite loop (zero length byte), unsigned counter underflow and out-of-buffer reads (non-zero length byte on a short residue), and a one-byte over-read (one-byte residue).

The TFTP server does not enforce an upper bound on DATA datagram size, accepting packets larger than the protocol maximum. This leads to a heap-buffer-overflow when copying data into FileX, enabling memory disclosure, and also allows an attacker to wedge the server thread by exhausting the packet pool. Both issues are reachable without authentication since TFTP has none.

On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first packet.

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

Electron is a framework for writing cross-platform desktop applications. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.