CVE Vulnerability Catalog

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could exploit it to achieve elevation of privileges, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

The elixir-protobuf library in versions from 0.8.0 before 0.17.1 contains an uncontrolled recursion vulnerability in Protobuf.JSON.Decode. An unauthenticated remote attacker can crash the decoding process via a deeply nested JSON document when the schema contains a self-referential or cyclic message type.

In the Linux kernel, bpf_sock_destroy() reads sk_protocol from the wrong structure, causing an out-of-bounds read. The issue affects TIME_WAIT and request sockets passed by the TCP iterator. The fix restricts the sk_protocol check to full sockets only.

In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.

In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.

In the Linux kernel, during veth channel resize, XDP program pointers are not cleared for removed RX queues. This can lead to running a freed program after a later channel increase, causing a system crash.

In the Linux kernel's net/sched subsystem, a vulnerability exists where tcf_action_delete() fails to check if the IDR lookup result is an error pointer (ERR_PTR). An attacker can exploit a race to replace an action with an error pointer, leading to a null-pointer dereference and kernel panic.

A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module was found, where ip6_route_lookup() can return a route without an inet6_dev (NULL pointer). An unprivileged user can trigger this state by lowering an external interface's MTU below IPV6_MIN_MTU, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).

In the Linux kernel, __vlan_insert_inner_tag() does not require the MAC header to be present before rewriting it. When a very short frame is sent through an IFF_TUN device, subsequent VLAN push operations can pull uninitialized slab bytes into the frame, leaking kernel memory.

In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.

In the Linux kernel, the xen/netfront driver does not validate the length of the first RX slot against ETH_HLEN before calling eth_type_trans(). If the first slot is shorter than an Ethernet header, a BUG() may occur in __skb_pull() or the header may be read past the end of the data.

The WP Rocket plugin for WordPress (versions before 3.23.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured security mechanisms.

The BeeTienda e-commerce platform (latest demo version) is vulnerable to reflected Cross-Site Scripting (XSS) in the 'search' parameter of the product list endpoint. Lack of proper input sanitization causes malicious payloads to be displayed insecurely in the HTML response, allowing arbitrary JavaScript execution in the victim's browser.

A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.

In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.

In the ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c), the 8-byte host-command request header was copied from the SPI Rx FIFO directly into the shared receive buffer data->in_msg, with protocol version and derived packet length checked only afterwards. The interrupt handler also accepted a chip-select assertion and an Rx-valid-length (RVLI) interrupt in any driver state other than SHI_STATE_DISABLED, allowing a new header to be parsed while the host-command thread was still processing the previous request from the same buffer. As a result of the race, the command handler could be handed a 65535-byte input length over a 256-byte buffer.