CVE Vulnerability Catalog

An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the management interface, potentially leading to full system compromise.

Lack of cryptographic mechanisms in Ghost Robotics Vision 60 robot (APK v5.5.0) enables man-in-the-middle attacks. An attacker on the local network can intercept and manipulate communications between the operator and the robot.

An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows multiple simultaneous sessions without client validation. An attacker with a modified app can connect during an active session.

Lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows an unauthenticated attacker on the Wi-Fi network full access to the web admin interface and HTTP API.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.

Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.

Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. Affects versions before 0.24.0.

Improper validation of certificate with host mismatch in Apache Thrift C++ bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift Java bindings from version 0.19.0 before 0.24.0 involves allocation of resources without limits or throttling, potentially leading to resource exhaustion (DoS).

An infinite loop vulnerability exists in Apache Thrift Python, Go, PHP and Java bindings. The issue affects versions before 0.24.0.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This affects Apache Thrift before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

In the Linux kernel, a vulnerability in the CAN BCM module has been fixed by switching the timer to HRTIMER_MODE_SOFT, which executes the callback in softirq context and removes the hrtimer_tasklet.

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.

In the rtl8723bs driver in the Linux kernel, the loop in is_ap_in_tkip() does not properly validate buffer bounds when processing information elements (IEs). This can lead to an out-of-bounds (OOB) read when accessing the IE header or its data.

In the NTFS3 filesystem in the Linux kernel, the log_replay() function does not validate the lcns_follow field during record conversion. A malicious filesystem image can provide an oversized lcns_follow value, causing an out-of-bounds (OOB) read during the memmove operation.