CVE Vulnerability Catalog

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

IBM WebSphere Application Server 9.0 and 8.5 is affected by improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

IBM i Access Family versions 1.1.5.0 through 1.1.9.12, specifically IBM i Access Client Solutions (ACS), is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation.

Microsoft Office SharePoint contains an OS command injection vulnerability. An authorized attacker can execute code remotely due to improper neutralization of special elements.

CloakBrowser prior to version 0.3.28 has a vulnerability in the cloakserve CDP multiplexer that allows an unauthenticated attacker to delete arbitrary directories by supplying a crafted fingerprint value with path traversal sequences. Additionally, cloakserve listens on 0.0.0.0 by default, increasing network exposure.

In Nextcloud Tables (versions 0.9.0 to 0.9.7 and 1.0.0 to 1.0.2), missing sanitization allows a user with access to perform a limited SQL injection in the ORDER BY clause, enabling extraction of a single bit per request or database delay.

Vulnerability in the Tables app in Nextcloud (versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, 1.0.0 to before 1.0.4). An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long via stored injection. The length limitation can be bypassed.

Vulnerability in the Node.js library parse-nested-form-data before version 1.0.1. The parseFormData() function does not filter reserved property keys when processing FormData field names, allowing prototype pollution of Object.prototype via a field name starting with __proto__ or containing .__proto__.

An improper authorization vulnerability in the calendar backend of Nextcloud Server (versions 32.0.0-32.0.8 and 33.0.0-33.0.2) allows an authenticated attacker, knowing another user's principal URL, to gain full read and write access to that user's calendar.

A stack-based buffer overflow flaw was found in rrdcached, a component of rrdtool. A local attacker with socket access can send an oversized CREATE request, crashing the daemon (denial of service) or potentially achieving arbitrary code execution.

F5-TTS through version 1.1.20 has a path traversal vulnerability in the finetune Gradio handlers. An unauthenticated attacker can write arbitrary files by passing unsanitized project names to os.path.join(), allowing bypass of the base directory and file creation at arbitrary locations.

Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.

The vulnerability in SMB volume mount handling in CloudFoundry Foundation diego-release allows a low-privileged CF space developer to inject arbitrary kernel CIFS mount options by bypassing the mount-option allowlist. This enables privilege escalation and security control bypass on multi-tenant Diego cells. Affects smb-volume-release before v3.60.0 and CF Deployment before v56.0.0.

FlexRIC v2.0.0 trusts the xapp_id field from E42 messages without binding it to the sender's SCTP association. A remote unauthenticated attacker can impersonate any xApp by sending requests to iApp (port 36422), causing misrouted responses and potentially crashing the victim xApp, RIC, or iApp due to state inconsistencies in the red-black tree.

In FlexRIC v2.0.0, an authorization bypass vulnerability exists in the iApp's xApp isolation mechanism. The function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id.

OpenAirInterface5G 2.4.0 (nr-softmodem) has a vulnerability in PRB utilization calculation in E2SM-KPM functions. Division by zero when two consecutive total_prb_aggregate samples are identical causes SIGFPE and crashes the nr-softmodem process, leading to 5G service interruption for all connected UEs. No authentication is required.

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a non-existent ran_func_id. Debug builds assert (SIGABRT), Release builds NULL pointer dereference (SIGSEGV). A remote unauthenticated attacker can send a crafted message to port 36421.

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence over SCTP to crash the process via SIGABRT.