CVE Vulnerability Catalog

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications.

Transmission of home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors (versions prior to 4.3.4 of the app and 01.50.001 of the monitor firmware) allows an attacker on the Wi-Fi Direct network to intercept the network password.

In Apache Airflow FAB provider, deactivating a user account does not invalidate previously issued tokens. These tokens remain valid and can be used to gain access even after the account is deactivated by an administrator.

In Apache ZooKeeper, the deleteContainer opcode (0x14/20) is processed without verifying ACL permissions, allowing any authenticated client to delete empty persistent, container, and TTL nodes even without proper permissions. This is an authorization bypass and ACL enforcement bug.

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

In Apache ZooKeeper, in FIPS mode, peer hostname verification in quorum TLS is not enforced. Despite enabling the relevant options, the connection accepts a CA-trusted certificate even if the SAN does not match the connected host, allowing a malicious certificate to join quorum traffic.

In Apache ZooKeeper, there is an information disclosure via SetWatches reconnect replay due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs.

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.

In the Linux kernel, in the ksmbd module, there is a vulnerability to out-of-bounds reads in share config responses. Lack of validation of IPC data sizes before processing variable-length fields can lead to reading beyond the allowed memory area.

A use-after-free vulnerability exists in the Linux kernel perf subsystem when perf mmap() revival races with the last munmap(). perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() to reattach a buffer that is then freed while another process still has it mapped.

In the Linux kernel, the gtp_newlink() error path lacks synchronize_net(), leading to a use-after-free. After clearing sk_user_data without waiting for an RCU grace period, concurrent packet reception in gtp_encap_recv() may still use a pointer to freed memory.

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of restart table growth during $LogFile replay. When mounting a crafted NTFS image, an entry count exceeding U16_MAX is truncated, causing allocation of a table smaller than required and an out-of-bounds access.

In the Linux kernel NTFS3 filesystem, read_log_rec_buf() reads out of bounds due to an invalid log->record_header_len value from disk. This can lead to reading memory beyond the buffer when mounting a crafted NTFS image.

In the Linux kernel's vfio/pci subsystem, vfio_msi_cap_len() freed vdev->msi_perm on an initialization failure but left the pointer dangling. This led to a use-after-free on the next device open and a double free on device close, potentially causing a kernel panic.

In the Linux kernel's Bluetooth SCO subsystem, sco_conn_ready() dereferences sk without holding conn->lock or a reference, leading to a use-after-free when the socket is closed concurrently. The fix holds an sk refcount and rechecks socket validity after lock_sock().

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation) can trigger the vulnerability.

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.