CVE Vulnerability Catalog

An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.

Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.

A vulnerability in the management interface of AOS-S could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-service condition on the affected system.

A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty prefix, a malicious container or local attacker could use a hostPath containing an intermediate absolute symlink, causing the bind mount source to resolve outside the intended prefixed root.

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.

In Twisted 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py passes characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing catastrophic backtracking. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output.

In yawkat LZ4 Java prior to 1.11.2, LZ4DecompressorWithLength trusts the four-byte decompressed-length header before validating input, allowing a five-byte input to request up to ~2 GiB and exhaust the JVM heap. Overloads writing to a caller-provided buffer are not affected.

In yawkat LZ4 Java prior to 1.11.2, LZ4BlockInputStream.refill() validates the compressedLen field as nonnegative but allocates a buffer of that attacker-controlled size before reading payload data. A header-only stream can request a near-2 GiB allocation and exhaust the JVM heap.

The yawkat LZ4 Java library versions 1.7.0 through 1.11.4 contain a vulnerability in the insecure creation of a temporary file. An attacker with access to a shared temporary directory can replace the native library file before it is loaded, potentially leading to code execution in the victim's context.

In yawkat LZ4 Java prior to 1.11.4, LZ4FrameInputStream.readHeader() allocates two 4 MiB block buffers for maximum-block-size frame headers, and the default concatenated-frame mode allows streams with many minimal empty frames to trigger ~8 MiB allocation per 11 input bytes without producing output.

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption.

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that allows an attacker to inject a '__proto__' key into a JavaScript object. This overwrites the object's prototype, potentially leading to security decisions based on attacker-controlled data.

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that does not enforce a maximum nesting depth. A sufficiently deep structure can cause a JavaScript stack overflow, leading to a crash of the process or service.

Handlebars from 4.0.0 to 4.7.10 accepts pre-parsed AST objects in compile() and precompile() while validating only selected values. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values, leading to code execution on the server. Applications that pass only template strings are not affected. Fixed in 4.7.10.

Handlebars versions from 3.0.0 to 4.7.10 are vulnerable because lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list. An attacker who can render a controlled template with allowProtoMethodsByDefault enabled can access the Function constructor via a bypass, allowing attacker-controlled JavaScript to execute with the server application's privileges.

In Handlebars from 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source in an inline script element, a closing script delimiter can end the element and cause following markup to be parsed and executed.