CVE Vulnerability Catalog

On platforms running Arista EOS with 802.1x authentication configured on access/trunk ports and routing enabled on the access VLAN, a malicious supplicant may bypass the requirement to perform 802.1x authentication.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files such as SSH keys, cloud credentials, or application tokens.

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

In the Zephyr RTOS network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c), a potential out-of-bounds write/read exists in the TLS socket connect path. When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. This can lead to reading and writing past the end of the address memory, potentially causing a crash and denial of service, and possibly arbitrary code execution.

IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.

Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.

An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The AD parsing loop reads an attacker-controlled length byte and computes reported_len - 3 without checking that reported_len >= 3. When reported_len is less than 3, the subtraction yields a negative value that bypasses the length guard and is then implicitly converted to a very large size_t when passed to net_buf_simple_pull_mem(). In builds without assertions, this wraps the buffer length and advances the data pointer far out of bounds, so subsequent reads dereference invalid memory. A nearby BLE device can trigger this with a non-connectable advertisement carrying a UUID16 AD structure and a crafted length byte, with no pairing or prior association required, potentially leading to denial of service or arbitrary code execution.

NAVTOR NavBox up to version 4.16.1.20 contains hard-coded credentials in its Windows Communication Foundation (SOAP) implementation. A local attacker can extract these credentials to bypass the intended transfer workflow and gain access to privileged WCF methods, enabling file write or overwrite within application-defined paths.

The codec-ohttp implementation in netty incubator codec.bhttp prior to version 0.0.22.Final does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path attacker can truncate the message and close the body without causing a decryption error.

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values.

A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads, causing a denial of service (DoS) via resource exhaustion.

Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of user input in text fields when creating a new document. An authenticated attacker can submit data containing JavaScript code that will be executed in the browsers of other users viewing the page.

In netty incubator codec.bhttp prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure, leading to an all-zero key. Also, EVP_HPKE_CTX_export returns an empty zero-filled array on failure, resulting in a deterministic, predictable AEAD key.

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.

Vulnerability in Net::Statsd for Perl before version 0.13 allows metric injection. Metric names are not sanitized for newlines, colons, or pipes, enabling injection of fake metrics. The update_stats and gauge methods do not validate numeric values.

The tarfile.data_filter function in Python can be bypassed using crafted symlinks, allowing files to be written outside the target directory during tar extraction. An attacker can place files in arbitrary locations.