CVE Vulnerability Catalog

A race condition in .NET Framework when using shared resources concurrently allows an unauthorized attacker to cause a denial of service over the network.

A heap-based buffer overflow in the Windows USB Print Driver allows an unauthorized attacker to elevate privileges through a physical attack.

An improper access control vulnerability in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

The 'profiling.sampling' module (Python 3.15+) and 'asyncio introspection capabilities' (3.14+) could be exploited to read and write addresses in a privileged process if that process connected to a malicious or 'infected' Python process via the remote debugging feature.

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR (PaaS and on-premise versions) allows an attacker to intercept sensitive data sent in plaintext. The flaw affects multiple versions from 7.3 to 7.6.

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR (PaaS and on-premise versions) allows an authenticated attacker to view cleartext passwords in responses to Secure Message Exchange and Radius queries, if configured. The issue involves sending sensitive data in an unencrypted form.

W Keycloak znaleziono lukę w stronie logowania do wyboru organizacji. Zdalny atakujący z uprawnieniami `manage-realm` lub `manage-organizations` może wykorzystać podatność na przechowywane Cross-Site Scripting (XSS), co pozwala na wykonanie złośliwego kodu JavaScript w przeglądarce użytkownika.

A side-channel vulnerability in BIP-39 mnemonic processing implementation in Trezor hardware wallets (versions 1.13.0-1.14.0) allows an attacker with physical access during setup to recover the mnemonic code using deep learning-based side-channel analysis. The issue has been patched.

W wyniku podatności typu Open Redirect w SAP NetWeaver Application Server ABAP, nieautoryzowany atakujący może stworzyć złośliwy adres URL, który po otwarciu przez ofiarę przekieruje ją na stronę kontrolowaną przez atakującego. Podatność ta ma niski wpływ na poufność i integralność aplikacji, nie wpływając na dostępność.

W wyniku podatności na wstrzykiwanie kodu w SAP NetWeaver Application Server Java (Web Dynpro Java), nieautoryzowany atakujący może dostarczyć spreparowane dane, które są interpretowane przez aplikację, co prowadzi do odwołania się do treści kontrolowanej przez atakującego. Jeśli ofiara uzyska dostęp do dotkniętej funkcjonalności, ta treść może zostać wykonana w przeglądarce ofiary.

In the libjq library (part of the jq tool), the jv_parse_sized() function has an out-of-bounds read vulnerability. When processing malformed JSON in a non-NUL-terminated buffer, the error formatting function uses %s which reads until a NUL terminator, ignoring the caller-supplied length.

In HAProxy before version 3.3.6, a vulnerability was found in the HTTP/3 parser. It does not verify that the received body length matches a previously declared Content-Length header when the stream is closed via a frame with an empty payload. The issue exists since version 2.6.

Cross-Site Scripting vulnerability in Snipe-IT asset management system versions 8.3.0 through 8.3.1. An authenticated attacker with minimal privileges can inject arbitrary JavaScript code via the "Name" and "Surname" fields. The code executes when the Activity Report or a modified profile is viewed by other users with sufficient permissions, provided the profile has no Display Name set.

In HCL DevOps Velocity, the rate limiting mechanism for login attempts is not properly enforced, allowing brute-force attacks after exceeding the unsuccessful login attempt limit. This vulnerability is fixed in version 5.1.7.

In the Linux kernel's netfilter nfnetlink_log, an uninitialized heap memory leak was found in the NFULA_PAYLOAD attribute. The __build_packet_message() function manually constructs the attribute, copying only payload data without zeroing the padding bytes, leaking kernel heap contents to userspace.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to the use of an uninitialized rtp_addr variable in the process_sdp function. When the SDP body lacks active media descriptions, the variable remains uninitialized, causing SIP session addresses to be overwritten with arbitrary stack data.

In the Linux kernel, a vulnerability in the netfilter x_tables subsystem allows xt_match and xt_target extensions registered with NFPROTO_UNSPEC to be loaded by the ARP protocol family. Due to mismatched hook masks (NF_INET_* vs NF_ARP), validation passes incorrectly, leading to NULL pointer dereference and kernel panic.

In the Linux kernel, the HFSC network scheduler (sch_hfsc) is vulnerable to a divide-by-zero in rtsc_min(). The issue occurs when the difference of two 64-bit scaled values exceeds 2^32 and is stored in a 32-bit variable, truncating it to zero and causing a division error.

A vulnerability was found in the Linux kernel's flow classifier (cls_flow) for shared QoS blocks. The flow_change() function calls tcf_block_q() and dereferences q->handle, which is NULL for shared blocks, causing a NULL pointer dereference and system crash.

In the Linux kernel, a NULL pointer dereference was found in the cls_fw classifier when using filters on shared blocks. The issue occurs when an empty cls_fw filter is attached to a shared block and a packet with a nonzero skb mark is classified, causing a system crash.