CVE Vulnerability Catalog

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In NR modem, there is a possible improper input validation, which could lead to remote denial of service, requiring system execution privileges.

Synology Assistant before version 7.0.7-50095 has incorrect default permissions. A local user can read or write arbitrary files and perform a denial-of-service attack during installation.

In the Wavlink WL-NU516U1 (version 708c073-mt7628), the config import function does not sanitize the Password argument, allowing remote OS command injection. The attack is complex but an exploit has been published.

The LogMyTrip WordPress plugin through 1.9 does not sanitize or escape a cookie value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on pages with the plugin's shortcodes.

The 'sm page duplicator' WordPress plugin through version 1.0.0 does not sanitize or escape a stored value before using it in a SQL statement when duplicating a page, allowing users with Editor role and above to perform SQL Injection attacks.

The ChamaWP WordPress plugin before version 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the MLS wire decoder allocates attacker-declared opaque length before bounds check.

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the KCCMBlockCipher MAC does not bind the nonce when AAD is absent, allowing cross-nonce AEAD forgery. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to the caller buffer before tag check. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the HSS public-key level count is unbounded, enabling huge memory allocation on verify. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, stringifying X.500 distinguished names has quadratic time complexity, causing excessive processing time. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In the Bluetooth driver, a missing permission check allows permission bypass. A local attacker with User privileges can escalate privileges without user interaction.

In the Telephony component, a missing permission check could allow local escalation of privilege without additional execution privileges and without user interaction.