CVE Vulnerability Catalog

The DI-7400G+ router has a command injection vulnerability in the sub_478D28 and sub_4A12DC functions of the jhttpd program, allowing attackers to execute arbitrary commands on the device via the ac_mng_srv_host parameter.

W mouse07410 asn1c w wersjach do 0.9.29 odkryto problem związany z dekoderami generowanymi przez asn1c, które nie egzekwują ograniczeń dla typu INTEGER, gdy wartość jest dodatnia i przekracza 32 bity. Może to prowadzić do przetwarzania niepoprawnych lub złośliwych danych wejściowych.

Nieprawidłowa kontrola dostępu w funkcji preHandle w SpringBootBlog v1.0.0 umożliwia atakującym dostęp do wrażliwych komponentów bez uwierzytelnienia.

Wersja 3.0.1-SNAPSHOT bloga zhisheng17 zawiera podatność na obejście uwierzytelniania. Atakujący może wykorzystać tę podatność do uzyskania dostępu do API bez konieczności posiadania tokena.

In OpenMediaVault 7.4.17, a vulnerability was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc, allowing local authenticated attackers to escalate privileges to root.

An initialization issue with state_ptrs was found in the xfrm_state_find function of the Linux kernel. Under preemption, a state lookup could hit a different CPU, and if a cached state was found, it was ignored and the 'acquire' block was entered using uninitialized state_ptrs.

In the Linux kernel, functions `cpu_switch_to()` and `call_on_irq_stack()` on ARM64 manipulate the stack pointer (SP) and Shadow Call Stack pointer (x18) non-atomically. Interrupts (SErrors, Debug Exceptions, pseudo-NMIs) can occur during the switch, causing stack mismatch and SCS pointer corruption, leading to kernel panics.

In the IIO (Industrial I/O) subsystem in the Linux kernel, a potential out-of-bound write vulnerability was found. The buffer is 20 characters long, and the simple_write_to_buffer function truncates data, but there is no check whether the input data fits in the buffer before copying.

In the Linux kernel, a vulnerability in the ASoC driver for Mediatek MT8365 passes an incorrect structure size to mt8365_dai_set_priv, causing a global-out-of-bounds read. This can lead to system crashes.

In the alienware-wmi-wmax platform driver for x86 in the Linux kernel, a vulnerability was found due to a missing empty element at the end of the dmi_system_id array named awcc_dmi_table. This could lead to out-of-bounds read during array processing.

In the Linux kernel, the Ceph filesystem function parse_longname() uses strrchr() on a string that is not NUL-terminated. This may lead to incorrect behavior or potential security issues.

W jądrze systemu Linux zidentyfikowano podatność w systemie plików gfs2, która dotyczy mechanizmu samoregeneracji. Gdy węzeł wycofuje się i jest jedynym węzłem z zamontowanym systemem plików, gfs2 próbuje odtworzyć lokalny dziennik, co prowadzi do dereferencji wskaźnika NULL.

In the Linux kernel, a vulnerability in the NVMe over PCI Endpoint Function (nvmet-pci-epf) driver causes double completion of commands after nvmet_req_init() fails. This sends two completions to the host and corrupts the NVMe target state, leading to a kernel oops.

In the rtw89 WiFi driver in the Linux kernel, there is a shift wrapping vulnerability in rtw89_core_mlsr_switch(). The link_id value from debugfs can exceed BITS_PER_LONG, causing incorrect shifting and potential out-of-bounds access. Limiting to IEEE80211_MLD_MAX_NUM_LINKS (15) fixes the issue.

In the Linux kernel iwlwifi driver, a code error causes ERR_PTR(0) (NULL) to be returned instead of a proper error code when iwl_setup_deferred_work() fails. This can lead to a use-after-free related to debugfs.

A use-after-free (UAF) vulnerability was found in the Linux kernel's proc_reg_open() function. The issue occurs when directly checking the proc_lseek pointer, which can lead to a security breach during module removal.

In the F2FS filesystem in the Linux kernel, there is an out-of-bounds read/write vulnerability in the devs.path array. When the device path length equals MAX_PATH_LEN, the lack of a null terminator causes adjacent structure fields to be treated as part of the path, leading to incorrect parsing.

In the Linux kernel's cfg80211 subsystem, a missing lock in cfg80211_check_and_end_cac() was found. The wdev_chandef() function requires the wiphy mutex, but the cfg80211_propagate_cac_done_wk() worker does not acquire it, triggering a warning and potential race condition.

In the Linux kernel, a vulnerability was found in the nf_hook_run_bpf() function in the netfilter BPF mechanism. The BPF program can be called without migration disabled in the packet transmit path, causing an assertion failure in __bpf_prog_run() and a system crash.

A slab-out-of-bounds read vulnerability was found in the Linux kernel's netfilter xt_nfacct module. The issue occurs when the nfacct_mt_checkentry() function assumes the account name is null-terminated, which is not always the case.