CVE Vulnerability Catalog

A flaw was found in the Linux kernel before version 5.12. The value of internal.ndata in the KVM API is mapped to an array index, which can be updated by a user process at any time, leading to an out-of-bounds write. The highest threat is to data integrity and system availability.

A vulnerability in Windscribe VPN for Mac and Windows versions up to 2.02.10 allows local privilege escalation via the WindscribeService component. A low-privileged user can exploit OpenVPN options to execute code as root/SYSTEM.

CODESYS Gateway w wersjach przed 3.5.16.70 zawiera błąd dereferencji wskaźnika NULL, który może prowadzić do awarii usługi (DoS).

In the Node.js mixme library before version 0.5.1, an attacker can add or alter object properties via '__proto__' using the mutate() and merge() functions. The polluted attribute is directly assigned to every object in the program.

Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. These are due to lack of proper input validation of HTTPS requests. An attacker could exploit these by sending a crafted HTTPS request to an affected device. This affects only specific AnyConnect and WebVPN configurations.

A vulnerability in the SIP inspection engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in DoS. The issue is a crash during a hash lookup for a SIP pinhole connection. An attacker can send crafted SIP traffic to trigger the crash and reload.

A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, bypassing the policy and delivering a malicious payload.

A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. This is due to insufficient boundary checks for specific data. An attacker could exploit this by sending a malicious HTTP request, potentially disclosing data fragments or causing a device reload and DoS.

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying OS. This is due to insufficient input validation. Exploitation involves uploading a crafted upgrade package file.

A vulnerability in the CLI of Cisco ASA and FTD could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS with root privileges. This is due to insufficient input validation of user-supplied commands.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.

Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. These are due to lack of proper input validation of HTTPS requests. An attacker could exploit these by sending a crafted HTTPS request to an affected device. This affects only specific AnyConnect and WebVPN configurations.