CVE Vulnerability Catalog

In certain NETGEAR devices, insufficient input validation allows authenticated administrators on the local network to tamper with the router's integrity.

Certain NETGEAR router models contain an insufficient input validation vulnerability that allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthorized modification of protected router software or functionality.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

The listed NETGEAR router models have a vulnerability due to insufficient input validation. Authenticated administrators connected to the local network can make unauthorized modifications to router software and functionality.

Listed NETGEAR router models have a buffer overflow vulnerability due to insufficient input validation, allowing authenticated administrators on the local network to make unauthorized modifications to router software and functionality.

The NETGEAR JR6150 (AC750) router contains an insufficient input validation vulnerability that allows administrators connected to the local network to make unauthorized modification of router software and functionality. The device reached End-of-Support in 2018 and no longer receives security updates. NETGEAR recommends replacing it with newer models.

Authenticated administrators on the local network can gain elevated access to the router and make unauthorized changes to router software and functionality.

NETGEAR Orbi 370 series devices are vulnerable to an attack where an attacker who can intercept and tamper with traffic between the router and the Internet can remotely execute commands on the device when the administrator performs specific management actions.

CWE-611 Improper Restriction of XML External Entity Reference vulnerability in Data Center Expert could lead to disclosure of server-side file contents. An attacker with a user account can submit crafted XML payloads to SOAP endpoints.

Fortinet FortiPortal versions 7.4.0 through 7.4.7, 7.2.0 through 7.2.8, and 7.0.x contain an improper access control vulnerability that may allow an attacker to gain unauthorized access via an unspecified attack vector.

Fortinet FortiOS and FortiProxy in multiple versions contain a vulnerability exposing an internal asset to an unsafe debug access level. This allows an authenticated admin to execute Lua scripts via crafted CLI commands.

In the Linux kernel, in the DAMON subsystem, a missing check for power-of-two min_region_sz in damon_start() can lead to invalid region address ranges. The issue has been fixed by adding the appropriate check.

In the Linux kernel, in the Nouveau driver (drm/nouveau), failure of aperture_remove_conflicting_pci_devices() during probe causes a leak of the nvkm_device object because the error path does not free it before returning. The issue has been fixed by jumping to the fail_nvkm label.

The Version module in the Elixir standard library (versions from 0.9.3 before 1.20.1) is vulnerable to uncontrolled resource consumption. An attacker controlling a version string can cause a denial of service through CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, leading to super-linear conversion and process crashes.

Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes (e.g., event handlers) into their container element in the host DOM. Due to a disabled CSP, a malicious plugin can execute arbitrary JavaScript in the privileged host context, potentially gaining unauthorized access to filesystem APIs. Only version v0.10.15 was tested and confirmed vulnerable; status of other versions is unknown.

Logseq is vulnerable to stored XSS. A malicious plugin can include JavaScript in the "name" field of its package.json, rendered via innerHTML without sanitization, allowing arbitrary code execution in the host context.

In the Linux kernel, in the EROFS filesystem, I/O requests beyond the end of the filesystem for file-backed mounts are not zeroed out, which could lead to data leakage. The issue has been fixed by properly zeroing such requests.

A stack buffer overflow was found in 389 Directory Server in the checkPrefix() function in pw.c. An attacker with Directory Manager privileges can store crafted credentials with an oversized algorithm ID, causing the LDAP server to crash. FORTIFY_SOURCE limits this to denial of service only.

In 389 Directory Server, the PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

A flaw was found in 389 Directory Server in the SMD5 password storage plugin. When processing a crafted password hash shorter than 16 bytes, an unsigned integer underflow occurs when computing salt length, causing a buffer over-read and crashing the LDAP server during authentication.