CVE Vulnerability Catalog

OmniFaces, a utility library for Faces, prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, contains a server-side EL injection vulnerability leading to Remote Code Execution (RCE). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side.

i18next-fs-backend prior to version 2.6.4 has a vulnerability that allows unencoded and unvalidated values to be injected into file paths, enabling an attacker to read or overwrite files outside the intended locale directory.

Versions of 18next-http-middleware prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process, leading to serious security issues.

i18next-http-middleware prior to version 3.9.3 allows injection of user-controlled language values into the Content-Language response header, potentially leading to CRLF attacks. This issue has been patched in version 3.9.3.

Akamai Guardicore Platform Agent and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory, enabling log file manipulation by unprivileged users.

lwjson version 1.8.1 contains an improper input validation vulnerability in the JSON parser. The end-of-string detection logic incorrectly identifies escaped quote characters, leading to applications hanging when processing valid JSON strings.

An issue was discovered in kosma minmea 0.3.0, where the minmea_scan functions format specifier copies NMEA field data to a caller-provided buffer without a size parameter. Applications using minmea_scan on untrusted input are vulnerable to a stack buffer overflow.

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. An attacker can send a malicious response from a Modbus TCP server, leading to buffer overflow and potential remote code execution.

ZEBRA, a Zcash node written in Rust, prior to version 4.4.0, incorrectly counts transparent signature operations against the 20000-sigop block limit, allowing it to accept blocks that zcashd rejects. This can lead to network splits.

In the Linux kernel, a vulnerability related to error handling in the emac_tx_mem_map() function has been fixed. In case of a mapping error, DMA mappings were leaked, which has been resolved by freeing them using the existing emac_free_tx_buf() function.

A vulnerability related to DMA mapping error handling in the SPI driver for Amlogic has been fixed in the Linux kernel. Issues included unnecessary gotos, double unmap, and incorrect unmap sizes.

In the Linux kernel, a vulnerability related to double-free in the remove() function of the rockchip-sfc driver has been fixed. The issue was caused by a manual call to spi_unregister_controller(), which could lead to a double-free.

In the Linux kernel, a vulnerability was found in the bonding mechanism where bond_setup_by_slave() directly copies the header_ops pointer from a slave device (e.g., GRE tunnel) to the bond device. This causes a type confusion because header functions like ipgre_header() use netdev_priv() to access device-specific private data, and when called on the bond device, they retrieve the bonding structure instead of the expected IP tunnel structure, leading to reading garbage values and kernel crashes.

A vulnerability in the Linux kernel related to duplicate device registration in netdev hooks has been fixed. The issue occurred during the handling of NETDEV_REGISTER notifications, which could lead to incorrect device registrations.

A vulnerability has been identified in the Linux kernel related to use-after-free in the iavf module during reset. This issue arises from improper thread management, which may attempt to access freed resources, leading to system crashes.

A vulnerability has been identified in the Linux kernel related to the io_uring mechanism, concerning the bounds check for 128-byte SQE_MIXED operations. The flaw involved validating the logical position instead of the physical SQE index, potentially leading to unauthorized memory access.

A vulnerability in the Linux kernel has been resolved in the mana_gd_setup() function. In the event of a setup error, the gc->service_wq pointer was set to NULL after destroying the workqueue, preventing a use-after-free error.

In the Linux kernel, a vulnerability related to the improper invocation of the css_put() function in scx_cgroup_init() has been resolved. This issue could lead to a reference count underflow, creating a risk of a Use-After-Free vulnerability.

In the Linux kernel, ALSA PCM has a use-after-free vulnerability on linked stream runtime in snd_pcm_drain(). The 'runtime' variable is reassigned to a linked stream's runtime, and after releasing the lock, accesses to runtime fields may refer to freed memory if the stream is concurrently closed. The fix caches needed fields into local variables before releasing the lock.

A vulnerability has been identified in the Linux kernel related to Rust Binder, allowing improper page insertion into the wrong virtual memory area (vma). The issue arises when a vma is closed and replaced with another vma at the same address, potentially enabling write access to pages that should be read-only.