CVE Vulnerability Catalog

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.

A vulnerability in djust (versions prior to 1.0.7) affects the default `update_model` event handler in `ModelBindingMixin`, allowing a client to set any public, existing view attribute over the WebSocket, not just fields bound with `dj-model=`. Protection relies only on rejecting `_`-prefixed names, a 14-entry denylist of framework internals, and an optional allowlist that defaults to allowing all. As a result, an attacker can modify attributes such as `account_id`, `is_admin`, or `total_price` if they are public and exist on the view.

Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (eval_handler). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely.

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts.

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.

A CWE-400: Uncontrolled Resource Consumption vulnerability exists in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.

A CWE-73: External Control of File Name or Path vulnerability exists in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.

A CWE-94 code injection vulnerability was identified in the Modbus CSV import workflow of Advantech EKI-1242EIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary Lua code on the device via a crafted imported file.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-94 code injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary code on the device, including OS commands as root.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.

A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.