1177 matches found
Linux Distros Unpatched Vulnerability : CVE-2023-37922
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary...
CVE-2025-55013 Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code
The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client taskhandler.py accepts a SHA-256 value returned by the service server and uses it directly as a local...
CVE-2025-55013 Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code
The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client taskhandler.py accepts a SHA-256 value returned by the service server and uses it directly as a local...
SUSE CVE-2025-54798
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...
DEBIAN-CVE-2025-54798
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...
CVE-2025-54798
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...
CVE-2025-54798: Improper Link Resolution Before File Access
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via the dir parameter. An attacker can cause files or directories to be written to arbitrary locations by supplying a crafted symbolic link that resolves outside the intended temporary directory. PoC const tmp =...
CVE-2025-7771: Exposed IOCTL with Insufficient Access Control
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...
curl: Use After Free (that leads to arbitrary Write for some versions)
Summary: - Use-After-Free vulnerability that leads to arbitrary write/READ YES, I used IA along with mermaind editor online one to generate this graph that show these paths for allocation, free and use after free F4637660: bugsvg.png Affected version - curl 8.13.0 x8664-pc-linux-gnu libcurl/8.13....
K000152613: Secure Boot Bypass vulnerability CVE-2025-3052
Security Advisory Description An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM...
CVE-2025-7026 SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0
A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values e.g., '$DB$' or '2DB$', the function performs arbitrary...
CVE-2025-7026
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register , which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match specific values (e.g., '$DB$' or '2DB$' ), the handler performs arbitrary writes...
CVE-2025-7026 SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0
A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values e.g., '$DB$' or '2DB$', the function performs arbitrary...
CVE-2025-7027 SMM Arbitrary Write via Dual-Controlled Pointers in CommandRcx1
A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable SetupXtuBufferAddress, while the write content is read from a...
CVE-2025-7027
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to perform arbitrary memory writes within System Management RAM (SMRAM) . The flaw stems from a double pointer dereference where the write target is derived from an unvalidated UEFI NVRAM variable (SetupXtu...
CVE-2025-7029 SMM Arbitrary Write via Unchecked OcHeader Buffer in Platform Configuration Handler
A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control the RBX register, which is used to derive pointers OcHeader, OcData passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory...
CVE-2025-7029
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) within GIGABYTE motherboard firmware allows a local attacker to control the RBX register . This register is used to derive OcHeader and OcData pointers for power and thermal configuration logic. Because these buffers lack proper v...
CVE-2025-7026: Undefined Security Weakness
A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values e.g., '$DB$' or '2DB$', the function performs arbitrary...
