CVE Vulnerability Catalog

A weak password recovery mechanism for forgotten passwords in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators can read and write the management file, but it is protected by Windows.

Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.

On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash.

In Eclipse Vert.x (vertx-grpc-server module), the configurable maximum message size limit for gRPC is applied to the compressed size rather than the actual uncompressed content size. This allows an attacker to send a compressed message that expands to far more memory than the configured limit.

The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.

In the Eclipse Vert.x MySQL client (vertx-mysql-client), the column definition array is pre-allocated based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server (or a man-in-the-middle attacker) can send a crafted packet with an extremely large column count, causing a massive heap allocation.

In the Eclipse Vert.x MQTT client (vertx-mqtt), MqttClient stores every inbound QoS 2 PUBLISH message in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet. This map has no size limit, and the maxInflightQueue option only constrains the outbound path.

In the binary array decoder of the Eclipse Vert.x PostgreSQL client (vertx-pg-client, DataTypeCodec.binaryDecodeArray), a Java array is allocated based on a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server (or an on-path attacker on an unencrypted connection) can send a crafted DataRow message with an excessively large array dimension value.

In the TDS message decoder of the Eclipse Vert.x MSSQL client (vertx-mssql-client), inbound TDS packets are aggregated into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag.

In Eclipse Vert.x, the uniqueItems keyword validation (vertx-json-schema module) uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time.

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash.

Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

In Rancher, a user with the ability to create a project on a certain cluster can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, leading to privilege escalation, because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

In Steve, by default an insecure option was used that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.