CVE Vulnerability Catalog

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility. On a system with multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 allows arbitrary file write outside the Trestle workspace via an attacker-influenced output path without path-traversal validation. This can lead to file overwrite, and with --force-overwrite to directory deletion and indirect code execution.

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 contains a server-side template injection (SSTI) vulnerability in the custom Jinja2 include tags mdsection_include and md_clean_include, which can lead to arbitrary code execution. Attacker-controlled OSCAL data can be executed as template code.

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 has a vulnerability in the URLSecurityValidator that guards remote-fetch paths against SSRF. It can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. Fixed in versions 3.12.4 and 4.1.0.

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.

The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.

TOTOLINK N600R 4.3.0cu.7647_B20210106 has a stack-based buffer overflow vulnerability in the setSystemConfig function of /cgi-bin/cstecgi.cgi. Manipulation of the Hostname argument leads to buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.

Doorkeeper OpenID Connect prior to 1.10.4 does not validate client-supplied scopes during Dynamic Client Registration (DCR). This allows a self-registered client to obtain scopes beyond what the server intended to grant, leading to privilege escalation.

Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

Doorkeeper version 1.9.0 has a vulnerability that allows an attacker who knows only a dynamically registered client's client_id, which is public, to authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because Dynamic Client Registration creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for client_secret_basic and client_secret_post. Only projects with Dynamic Client Registration enabled (disabled by default) are affected.

Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.

The Drupal Edit in-place field module has an Incorrect Authorization vulnerability that allows Forceful Browsing. Affected versions: from 0.0.0 to 2.1.1.