CVE Vulnerability Catalog

In the Modem module, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.

In the display module, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.

In the apu module, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not required for exploitation.

In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.

In the battery component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker already has System privilege. User interaction is not needed for exploitation.

In the ccci component, there is a possible out-of-bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if an attacker already has System privilege. User interaction is needed for exploitation.

In the Modem component, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.

In the Modem component, there is a possible system crash due to improper input validation. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.

Dynamically-determined object attributes vulnerability in Jeebase 0.0.1. Affects the updateUser function in the file /user/update/info in the UserService component, where manipulation of user/tempUser arguments leads to dynamically-determined object attributes. The attack can be executed remotely, and the exploit is public. The project has not responded.

A SQL injection vulnerability was found in SourceCodester Drug Recommendation System 1.0 within the mysqli_real_escape_string function of /Admin/add_symptom.php (Symptom Creation component). Manipulating the txtname argument allows SQL injection. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function of /Admin/add_drug.php (Drug Creation component). Manipulating the txtname/cmdtype/txtusage/txtsideeffect/cmdcontraindication arguments leads to SQL injection. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was determined in SourceCodester Drug Recommendation System 1.0 in an unknown function of /Admin/edit_class.php. Manipulating the ID argument leads to SQL injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.

Gerapy up to 0.9.13 contains a path traversal vulnerability in the project_create function of gerapy/server/core/views.py (Project Management component). Manipulating the project_name argument leads to path traversal. Remote exploitation is possible and the exploit has been disclosed publicly. The patch identifier is 6e481078cfba6388a67ca2d9792288405019ba3e.

A vulnerability was detected in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown functionality of admin/admin.php (Role Attribute Handler component). Manipulating the Name argument leads to authorization bypass. The attack can be launched remotely and the exploit has been publicly disclosed. The product does not use versioning, so affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed but has not responded.

A SQL injection vulnerability was identified in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown function of admin/admin.php (Order Assignment Block component). Manipulating the order_id/delivery_person_id arguments leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available. The product uses a rolling release, so no version details are available. The project was informed but has not responded.

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb.

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208.

A flaw has been found in invariant-systems-ai aiir up to 1.7.0 in an unknown function of the Policy Gate Handler component. Manipulation can lead to improper verification of cryptographic signatures, and the attack can be executed remotely. The project is no longer maintained and its GitHub repository is unavailable.

YesWiki before 4.6.7 contains a cross-site scripting (XSS) vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.