CVE Vulnerability Catalog

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/sh_for_telnet.

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.

The memcached cache plugin in the community.general Ansible collection does not perform explicit serialization, relying on python-memcached which pickles values on write and unpickles on read. Because memcached is unauthenticated and cache keys are predictable, an attacker can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is read, leading to remote code execution.

In SSSD's IdP authentication provider, the eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

In the Linux kernel, in the crypto: krb5 module, crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free the buffer holding freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object. This can lead to sensitive data leakage.

In the Linux kernel, in KVM: s390 vsie, when shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

In the Linux kernel, a use-after-free vulnerability in the Bluetooth ISO subsystem was fixed in iso_conn_ready. The issue occurred when the listening socket was closed concurrently, leading to use of freed memory when creating a child socket.

An OS Command Injection (CWE-78) vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.

Dell iDRAC9 (14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50) and Dell iDRAC10 (17G versions prior to 1.30.30.50) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint.

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the FreeIPA/IdM Web UI password reset page. An unauthenticated remote attacker can exploit it by enticing a victim to click a crafted link and complete a password reset, allowing injection and execution of arbitrary JavaScript in the victim's session.

An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior.

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

eprosima Fast DDS is a C++ implementation of the DDS standard. Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, the SQL-based content filtering implementation (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP DATA submessage with a deeply nested filter expression in PID_CONTENT_FILTER_PROPERTY.filterExpression.

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.