CVE Vulnerability Catalog

A use-after-free vulnerability due to a race condition exists in BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. During SIG(0) signature validation, if the 'recursive-clients' limit is reached and the message is discarded, validation may attempt to read the discarded message. Versions 9.18.28-9.18.49 and 9.18.28-S1-9.18.49-S1 are not affected.

Multiple flaws in `named` related to handling DNS messages with non-IN classes (e.g., CHAOS, HESIOD) or meta-classes (ANY, NONE). Specially crafted requests can cause assertion failures in `named`.

Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.

A vulnerability in Windows Admin Center due to improper access control. It allows an authorized attacker to elevate privileges over a network.

The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

A use-after-free vulnerability in the DNS-over-HTTPS implementation in BIND 9 versions 9.20.0-9.20.22, 9.21.0-9.21.21, and 9.20.9-S1-9.20.22-S1. Versions 9.18.x are not affected.

Vulnerability in BIND servers configured to use TKEY authentication with GSS-API tokens. Receiving crafted packets can lead to excessive memory consumption, resulting in Denial of Service.

Rsync before version 3.4.3 contains a TOCTOU race condition in daemon file handling, allowing attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

A CSRF vulnerability in WISECP from Sitemio Information Technologies Trade Ltd. Co. allows Cross-Site Request Forgery attacks. The vendor did not respond to the disclosure.

Vulnerability in the Meona client and server components (Mesalvo) allows export of user data, including cleartext passwords, via the SQL editor. Affects client versions up to 19.06.2020 15:11:49 and server versions up to 2025.04 5+323020.

Improper access control in Meona Client Launcher and Meona Server components allows a normal user to gain access to the admin panel. Affects versions up to 19.06.2020 (Client Launcher) and up to 2025.04 5+323020 (Server).

In 389-ds-base, the get_ldapmessage_controls_ext() function does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a crafted request with hundreds of thousands of minimal controls, causing excessive CPU consumption and heap allocation.

PluginScript attempts to chroot the plugin to the repoManagerRoot, which is often / (the system root) in standard configurations. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges.

NLnet Labs Unbound up to version 1.25.0 inclusive contains a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. The issue stems from using the wrong counter to calculate write offsets for ADDITIONAL section rrsets. An attacker controlling a DNSSEC-signed domain can trigger a crash with a single query.

A vulnerability in Unbound (versions 1.14.0 through 1.25.0) causes a heap overflow when encoding multiple NSID, DNS Cookie, and EDNS Padding options in the reply packet. A flaw in the EDNS field size calculation leads to out-of-bounds write.

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch limiting acceptable incoming EDNS options to 100.

In the `socket_handler` function in `src/havegecmd.c` of haveged, the credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`) is incomplete. Although it detects that the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), the code **fails to stop execution** and proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Unbound versions 1.16.2 through 1.25.0 are vulnerable to a 'ghost domain names' attack that can extend the ghost domain window by one TTL value. The attacker needs control over a ghost zone and the ability to query a vulnerable Unbound. A fix is available in version 1.25.1.

The AcyMailing WordPress plugin up to version 10.8.2 does not properly verify user permissions, allowing authenticated attackers with subscriber-level access to modify configuration, export subscriber secret keys, and take over administrator accounts.