CVE Vulnerability Catalog

FlexRIC v2.0.0 has a reachable assertion in e2ap_recv_sctp_msg(). Sending a single SCTP message with payload >= 32768 bytes crashes near-RT RIC, iApp, E2 Agent, or xApp via SIGABRT. Release builds suffer integer overflow.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup returns NULL, causing assert (SIGABRT) in Debug or dereference (SIGSEGV) in Release. A remote unauthenticated attacker can send a request to port 36422.

A missing authentication vulnerability was found in claw-orchestrator up to version 3.5.5 in the EmbeddedServer function in the file src/embedded-server.ts of the API Endpoint component. The attack can be performed remotely, and the exploit is publicly available.

The mcpilot tool version 0.1.0 by horizon921 is vulnerable to server-side request forgery (SSRF) in the MCP API Call endpoint. Manipulation of the serverBaseUrl argument allows a remote attacker to send requests to internal network resources.

In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.

The Windows kernel driver PCTCore64.sys from PC Tools Internet Security has improper access control, allowing user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker can exploit this to perform sensitive operations on the system.

In the Linux kernel, a vulnerability in the SMB client was fixed that allowed userspace to create cifs.spnego keys with authority-bearing fields (such as pid, uid, creduid, upcall_target) via request_key(2) or add_key(2). Now only kernel-originating descriptions are accepted.

Nextcloud (an open source content collaboration platform) versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0 have a missing signature verification in User OIDC, allowing a malicious ID4me authority to impersonate any user.

GiveWP WordPress plugin is vulnerable to DOM-Based XSS due to improper input neutralization during page generation. Affects versions up to 4.14.5.

The WP Document Revisions plugin for WordPress lacks authorization, allowing exploitation of incorrectly configured access control security levels. Affects versions before 4.0.0.

Missing Authorization vulnerability in Themefic Hydra Booking up to version 1.1.41. It allows exploiting incorrectly configured access control security levels.

The Advanced Access Manager (AAM) plugin for WordPress up to version 7.1.0 has an authentication bypass vulnerability via URL encoding spoofing. An attacker can bypass authentication mechanisms.

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data.

ESA AnomalyMatch before version 1.3.1 loads model files from session directories using torch.load() with unrestricted deserialization. Attackers can execute arbitrary code via crafted model checkpoint files.

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.

FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqueness via assert(), allowing a remote unauthenticated attacker to crash the iApp process via SIGABRT.

FlexRIC v2.0.0 has a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.

FlexRIC v2.0.0 uses hardcoded assertions to validate IE counts in decoded E2AP messages. A remote unauthenticated attacker can crash the near-RT RIC or iApp via SIGABRT by sending a valid PDU with unexpected IE count.