CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability has been discovered in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromDhcpListClient function of the /goform/DhcpListClient file. An attacker can remotely exploit this flaw by manipulating the page argument, potentially leading to arbitrary code execution.

A stack-based buffer overflow vulnerability was found in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSetIpBind function of the /goform/SetIpBind file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution.

A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

A vulnerability in FactoryTalk® Services Platform (FTSP) allows bypassing JWT signature validation during Okta Web Authentication. The application fails to verify that the JWT algorithm is set to RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens.

A vulnerability in the LwM2M library of Zephyr RTOS copies the firmware-update Package URI into a fixed buffer without length validation. An attacker can write a URI of 128-254 characters, causing an out-of-bounds read of adjacent static memory, information disclosure, and potential device crash.

In Zephyr's kernel pipe implementation, the syscall verifier z_vrfy_k_pipe_init() uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing an unprivileged thread to re-initialize an already-in-use pipe. Re-initialization resets buffers and wait queues without waking blocked threads, leaving them orphaned and corrupting kernel structures.

In Xtensa systems with MPU and userspace enabled, arch_buffer_validate() defaulted to 0 (access permitted), allowing validation bypass when the rounded buffer extent wraps the 32-bit address space. An unprivileged user thread could pass crafted (addr, size) to any syscall validating user buffers, gaining access to kernel or other-partition memory.

A stack-based buffer overflow vulnerability has been detected in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSafeMacFilter function of the /goform/SafeMacFilter file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution. The exploit has been publicly disclosed.

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. Improper validation of user-supplied data can result in an out-of-bounds write.

A memory corruption vulnerability exists in Arena® Simulation within the linker.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write.

A memory corruption vulnerability in Arena® Simulation's expmt.exe (Siman) component due to improper validation of user-supplied data leads to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the current process context by tricking a user into opening a malicious file.

A memory corruption vulnerability exists in Arena® Simulation within the model.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

An improper privilege management vulnerability has been discovered in Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. This flaw could allow an attacker to escalate privileges on the system.

A stack-based buffer overflow vulnerability has been identified in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Manipulating the page argument allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.

A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro router version 16.03.66.23, specifically in the fromSafeClientFilter function of the /goform/SafeClientFilter file. An attacker can remotely manipulate the page argument to trigger the overflow. The exploit has been publicly released and may be used in attacks.

A vulnerability in the Sesame Time web application and its REST v3 API allows session impersonation due to insufficient access control. The system uses the session identifier (USID) as the sole validation mechanism without verifying its ownership, and does not revoke old sessions upon new logins. An attacker with a valid USID can impersonate a victim and access confidential data including emails, user IDs, roles, and corporate information.

A vulnerability in SIMATIC S7-PLCSIM Advanced (all versions) involves improper handling of high-volume multicast traffic, leading to memory exhaustion. An unauthenticated attacker on the local network segment can cause a denial-of-service (DoS) condition, making the application inaccessible until a manual restart. The attack requires a specific project configuration to be active on the target instance.

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The Web Console and REST API components use this header for audit context initialization, and Jetty's ForwardedRequestCustomizer is unconditionally installed, allowing an attacker to control the logged IP address.

A vulnerability in the Mint library for Elixir allows a remote HTTP server to exhaust client memory and cause a denial of service (DoS). The HTTP header decoding functions accumulate headers without limits, and the parser has no cap on the number or size of headers, enabling an attacker to stream infinite header lines without a terminating blank line.

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.