CVE Vulnerability Catalog

A vulnerability in AmpereOne processors allows an out-of-bounds write in the PCIe driver's S-EL0 address space via a malformed SMC call to UEFI-MM. Affects AmpereOne AC03 before 3.5.9.3, AC04 before 4.4.5.2, and M before 5.4.5.1.

Apache Commons Text before 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Some interpolators could trigger actions like executing commands or accessing external resources, potentially leading to remote code execution. This has been fully addressed in FileMaker Server 22.0.4.

NVIDIA Isaac Lab zawiera podatność na deserializację. Udane wykorzystanie tej podatności może prowadzić do wykonania dowolnego kodu.

A Path Traversal vulnerability in Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying OS, leading to full RCE.

Mercury D196G router with firmware d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to a buffer overflow in function sub_404CAEDC via the password parameter.

Mercury D196G router with firmware d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to a buffer overflow in function sub_404CAEDC via the fac_password parameter.

PodcastGenerator w wersji 3.2.9 zawiera podatność na ślepą serwerową fałszywą prośbę (SSRF), która umożliwia atakującym wstrzykiwanie XML w formularzu przesyłania odcinka. Atakujący mogą manipulować parametrem 'shortdesc', aby wywołać zewnętrzne żądania HTTP do dowolnych punktów końcowych podczas tworzenia odcinka podcastu.

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.

W jądrze Linuxa naprawiono podatność związaną z wykrywaniem potencjalnie uszkodzonych identyfikatorów w liście wolnych identyfikatorów (free_nid_list) w systemie plików f2fs. Została dodana kontrola poprawności w funkcji f2fs_alloc_nid() w celu wykrycia ewentualnych uszkodzeń.

In the Linux kernel's atlantic driver for Aquantia network cards, a vulnerability exists due to missing fragment count validation in the RX path. Packets with more than 17 fragments cause an out-of-bounds write in skb_add_rx_frag_netmem(), leading to a kernel panic.

In the Linux kernel's libceph, a use-after-free vulnerability was found in have_mon_and_osd_map(). Lack of locking when accessing monmap and osdmap can cause dereference of freed memory, as shown by KASAN errors.

In the Linux kernel's libceph library, the handle_auth_session_key() function lacks validation of the length field from network packets. The len field originates from untrusted packets, potentially leading to out-of-bounds writes when decrypting the connection secret or processing service tickets.

The vulnerability in Blue Mail 1.140.103 and earlier causes documents to be saved to the file system without a Mark-of-the-Web tag when using the attachment interaction functionality. This allows attackers to bypass the built-in file protection mechanisms of Windows OS and third-party software.

A vulnerability in Canary Mail 5.1.40 and earlier causes documents to be saved without a Mark-of-the-Web tag when using the attachment interaction functionality. This allows attackers to bypass built-in file protection mechanisms of Windows OS and third-party software.

In the Linux kernel, a vulnerability was resolved in the ksmbd: ipc module — a use-after-free in ipc_msg_send_request. The ipc_msg_send_request() function waits for a generic netlink reply using an ipc_msg_table_entry on the stack; the generic netlink handler fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() validated and freed entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() copies data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN.

In the Linux kernel's USB network driver qmi_wwan, the qmimux_rx_fixup function does not initialize the MAC header offset for raw IP packets. This leaves skb->mac_header uninitialized, potentially causing a kernel panic on ARM64 when subsystems like xfrm access the offset.

In the mlx5e driver (Linux kernel), a bug was found in XDP buffer handling for striding RQ. XDP programs can change the xdp_buff layout, but the driver assumed it was unchanged, leading to erroneous skb generation or a kernel warning.

An SQL injection vulnerability has been reported to affect several QNAP operating system versions. Remote attackers can exploit the vulnerability to execute unauthorized code or commands. Fixes are available in QTS 5.2.7.3297 build 20251024 and later, QuTS hero h5.2.7.3297 build 20251024 and later, and QuTS hero h5.3.1.3292 build 20251024 and later.