CVE Vulnerability Catalog

The vulnerability in DDSN Interactive cm3 Acora CMS version 10.1.1 stems from improper access control. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.

A flaw was found in grub2's UFS module when handling symbolic links. The function checking symlink data size does not verify overflow, leading to undersized buffer allocation and heap out-of-bounds write. An attacker can craft a malicious filesystem to corrupt heap memory and achieve arbitrary code execution, bypassing Secure Boot.

A flaw in Grub2 allows the dump command to read arbitrary memory even when Grub is in lockdown mode, enabling an attacker to extract sensitive information such as signatures and salts from memory.

A flaw in grub2's calculation of the translation buffer when reading a .mo file in grub_gettext_getstr_from_position() may overflow, leading to an out-of-bounds write. An attacker can exploit this to overwrite sensitive heap data, ultimately bypassing Secure Boot protections.

A flaw in the GRUB2 command/gpg component causes hooks created by loaded modules not to be removed when the module is unloaded. This allows an attacker to trigger a use-after-free vulnerability by calling a hook after its module has been freed. Successful exploitation could lead to arbitrary code execution and bypass of Secure Boot protections.

A flaw was found in the GRUB2 bootloader in the HFS+ filesystem driver. When failing to mount an HFS+ partition, the driver does not properly set an ERRNO value, which may lead to a NULL pointer access.

A flaw was found in grub2 where it fails to validate the string length when reading a symbolic link's name from a UFS filesystem. This lack of validation may lead to a heap out-of-bounds write, compromising data integrity and potentially allowing an attacker to bypass Secure Boot protections.

In the grub_mofile_open() function when reading a language .mo file, GRUB2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead to buffer size calculation overflow, resulting in out-of-bound reads and writes.

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the argument list, but fails to check if the allocation succeeded. If allocation fails, the parse_option() function processes a NULL pointer, causing grub to crash or, in rare scenarios, corrupt IVT data.

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key.

A flaw in grub2 allows an attacker to cause an out-of-bounds write by providing a specially crafted JPEG file to the JPEG parser. This can lead to memory corruption.

Podatność typu 'Open Redirect' w systemie HAVELSAN Liman MYS umożliwia przekierowanie użytkowników do nieufnych stron. Problem ten dotyczy wersji Liman MYS przed 2.1.1 - 1010.

Podatność typu 'Path Traversal' w serwerze KLog firmy Komtera Technologies pozwala na manipulację danymi wejściowymi z sieci w wywołaniach systemowych do plików. Problem ten dotyczy wersji KLog Server przed 3.1.1.

W bibliotece GNU elfutils w wersji 0.192 zidentyfikowano krytyczną podatność, która dotyczy funkcji __libdw_thread_tail w pliku libdw_alloc.c komponentu eu-readelf. Manipulacja argumentem w prowadzi do uszkodzenia pamięci.

In MISP before version 2.4.198, the app/Model/Attribute.php file ignores ACL rules during a GUI attribute search.

In hostapd version 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker who previously successfully bootstrapped public keys with another entity using PKEX can subvert future bootstrapping by passively observing public keys, reusing the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This yields the public ephemeral key X, the only element required to subvert the PKEX association.

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

A flaw was found in npm-serialize-javascript where the module does not properly sanitize certain inputs like regex or other JavaScript object types, allowing an attacker to inject malicious code. This code can be executed during deserialization in a web browser, leading to Cross-site scripting (XSS) attacks.

Smartcom Ralink CPE/WiFi routers SAM-4G1G-TT-W-VC and SAM-4F1F-TT-W-A1 have a weak default WiFi password generation algorithm. This allows a remote attacker to recover the password and gain network access.

In SourceCodester Packers and Movers Management System 1.0, a Cross-Site Request Forgery (CSRF) vulnerability exists in Users.php. It allows attackers to create unauthorized admin accounts by sending crafted requests to an authenticated admin user.