CVE Vulnerability Catalog

In the Linux kernel's firewire: ohci driver, a NULL pointer dereference vulnerability was found in ar_context_release(). The issue occurs during the error handling path of the probe function when the context was not initialized, and the devres cleanup mechanism triggers release. An attacker could exploit this to cause a kernel crash (system panic).

Http4s before versions 0.23.35 and 1.0.0-M47 has a DoS vulnerability via HTTP/2 in the Ember backend. The Hpack wrapper does not include indexed headers or per-header overhead in the header size limit, allowing a small block to expand into a large in-memory representation. Multiple malicious connections can exhaust process memory.

Starlette-Admin before 0.16.1 does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user can sort or filter on unintended fields, leading to limited information exposure and potential HTTP 500 errors.

IzPack version 5.2.6 and earlier has a path traversal vulnerability allowing writes outside the installation directory. The unpack() function does not normalize paths or enforce destination containment, allowing entries with '../' sequences to write to arbitrary locations.

kas, a setup tool for bitbake based projects, prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity.

Kyverno, a policy engine for cloud native platform engineering teams, from 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

LogTape before versions 1.3.11, 2.0.14, and 2.1.5 has a vulnerability in the @logtape/syslog package that allows injection of forged syslog records. The escapeStructuredDataValue() function does not neutralize control characters, and formatStructuredData() does not validate keys, enabling manipulation of frames and data elements.

A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

The Seattle FilmWorks plugin in GIMP has a vulnerability involving unbounded stack allocation of a variable-length array when processing a specially crafted SFW file. This leads to an application crash and denial of service.

GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.

Rently Smart Home versions 20.1.0 and prior have an Insufficiently Protected Credentials vulnerability. An attacker can retrieve pins including the Master Pin, overriding standard user permissions.

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk before 3.5.5.

RustDesk before version 1.4.7 has an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length in the frame header and reserves memory before receiving data, allowing memory exhaustion via multiple TCP connections.

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. A remote peer can write files outside the intended target directory using parent-directory components or absolute paths.

GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.

Liderahenk from version 3.4.0 before 3.5.5 has an LDAP Injection vulnerability. Improper neutralization of special elements in an LDAP query allows manipulation of queries.

GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.

The Formidable Charts plugin for WordPress up to version 2.0.1 has a Directory Traversal vulnerability via the 'frm_graph' parameter. An unauthenticated attacker can read the contents of arbitrary files on the server if certain conditions are met.

GitLab EE versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with developer-role permissions to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.