CVE Vulnerability Catalog

Improper restriction of software interfaces to hardware features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing critical model-specific registers.

Exposed dangerous method or function in ASUS Armoury Crate allows a local user to cause a brief system stall by bypassing driver authentication and sending requests to trigger system management interrupts (SMIs). Repeatedly triggering SMI may lead to a denial-of-service (DoS) condition.

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclose information and disable device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.

Allocation of resources without limits or throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount of memory.

Sensitive information in resource not removed before reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism.

Exposure of sensitive system information to an unauthorized control sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.

Release of invalid pointer or reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).

Exposed IOCTL with insufficient access control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification.

A permissive cross-domain security policy with untrusted domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

A Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence allows an attacker to cause the server to initiate arbitrary outbound requests. Combined with XML/XSL processing, this could enable script execution. Successful exploitation may have a low impact on confidentiality, integrity, and availability.

SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server allow an authenticated low-privileged attacker to access certain administrative functionality or interfaces and obtain sensitive system state information, resulting in information disclosure. This could facilitate further attacks. The vulnerability has a high impact on confidentiality, with no impact on integrity or availability.

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. This could expose security-relevant settings and internal system details, with low impact on confidentiality while integrity and availability remain unaffected.

SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain functionality. A low-privileged attacker could send specially crafted requests to delete entries that should not be accessible. This results in a low impact on availability, with no impact on confidentiality and integrity.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow access to sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability.

Vulnerability in ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. The resolve_secret/3 function treats any return other than {:ok, _} or :error as a valid secret, allowing bypass of protections.

SSRF vulnerability in ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. The public_ip?/1 function incorrectly classifies certain address ranges as public, allowing policy bypass.

Vulnerability in ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. The resource_metadata value is interpolated without proper escaping, allowing header modification and redirecting clients to a malicious authorization server.

Vulnerability in ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. Responses with metadata are marked as Cache-Control: public without a Vary header, causing responses to be cached and served to other tenants.