CVE Vulnerability Catalog

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

Integer overflow in UEFI firmware for Intel(R) Slim Bootloader may allow information disclosure. A system software adversary with an authenticated user and low complexity attack may cause denial of service. The attack requires local access and user interaction.

Out-of-bounds write in firmware for Intel(R) Slim Bootloader may allow denial of service. A privileged user with low complexity attack can cause denial of service. The attack requires local access but no user interaction.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution.

Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.

The vulnerability in cti-transmute renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised MISP server can return crafted values that inject HTML or script-capable content into the interface.

On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the Floating point ABI choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled, and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off.

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.

SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

The vulnerability in the UpdateHub subsystem (subsys/mgmt/updatehub/updatehub.c) is due to unsynchronized access to the shared ctx structure. Concurrent operations (background autohandler and user-triggered calls) can write past the fds[1] array, overwriting adjacent struct fields, leading to internal state corruption and denial of service in the firmware update path.

The UpdateHub OTA client leaks a CoAP/DTLS socket descriptor on connection-setup failure paths. A bug in cleanup logic prevents the socket from being closed, and the open descriptor is overwritten on the next attempt, permanently leaking it from the socket pool until reboot.

A NULL pointer vulnerability has been found in the shim application of the dp.c library. The missing NULL check could allow attackers to perform a denial of service attack on a system using the shim application for UEFI bootloader.

The UpdateHub OTA client in Zephyr OS contains an uninitialized heap memory read and out-of-bounds read in z_impl_updatehub_probe(). A malicious UpdateHub server can send a crafted response that, after a failed first JSON parse, uses a non-NUL-terminated metadata_copy buffer, leading to a read past the allocated memory and potentially crashing the device.