CVE Vulnerability Catalog

A NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

An improper validation of consistency within input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.

A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.

Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) has an improper validation of consistency within input. A malicious TLS 1.3 server can cause a denial of service of the ssl application on the client node by sending a NewSessionTicket message with invalid extensions.

F´ (F Prime) prior to 4.3.0 has a vulnerability in Svc::FileUplink where the destination path from a StartPacket is copied and opened for writing without canonicalization or confinement to an upload directory. This allows creating or overwriting files at attacker-selected locations.

F´ (F Prime) prior to 4.2.0 has a vulnerability in Svc::Ccsds::SpacePacketDeframer where the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting the buffer. When a telecommand frame leaves six or fewer bytes, the assertion aborts or resets the process, causing denial of service.

A flaw was found in DPDK lib/vhost where a guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

A flaw was found in DPDK lib/vhost where a double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

A flaw was found in DPDK lib/vhost where a TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.

A vulnerability in ethernet_recv() in subsys/net/l2/ethernet/ethernet.c in the Zephyr network stack. When the ethertype is 0x8100 and VLAN is enabled on the interface, the received frame buffer is reinterpreted as an 18-byte net_eth_vlan_hdr without re-checking the length, causing an out-of-bounds read and raising hdr_len to 18. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers the issue.

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.

In the mtrudel bandit library, an unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by trickling small WINDOW_UPDATE frames. Each partial progress resets deadlines, so the blocked stream process, its Plug state and held resources stay alive as long as the attacker keeps dripping, exhausting server processes and memory. This issue affects bandit from 1.4.0 before 1.13.0.

A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS. A malicious or compromised SDN-controller can cause a complete outage of the OVSDB control plane and possibly remote code execution.

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote network attacker can cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A configured EVPN signaling peer can cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update, resulting in a denial of service affecting routing adjacencies.