obsidian-tc: Authorization Bypass

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token JWT has no vault claim, and the folder access-control list is...

Getrebuild Rebuild authorization issue vulnerability

Getrebuild Rebuild 4.5.0 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization checks in the TaskCommentController.commentList component. It allows authenticated, low-privilege users to read task comments without having project membership. Attacke...

deltaww ispsoft buffer error vulnerability

deltaww ispsoft versions prior to 3.25 contain a buffer overflow vulnerability. This vulnerability stems from an issue with out-of-bounds read attacks, which could allow remote attackers to disclose sensitive information...

FreeRDP buffer error vulnerability

FreeRDP versions from 3.0.0 to 3.32.0 have a buffer error vulnerability. This vulnerability stems from an out-of-bounds read issue in the Windows RAIL client. A malicious RDP server can trigger excessive heap reading by sending window titles that do not end with NUL. Attackers can send a...

Dromara Jpom authorization issue vulnerability

Dromara Jpom 2.11.12 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass in SshFileController. Attackers can access SSH hosts in other workspaces by providing external SSH asset IDs. Attackers with SSH file permissions can call...

R. S. Doiel antiword buffer error vulnerability

R. S. Doiel’s Antiword versions 0.37 and earlier have a buffer error vulnerability. This vulnerability stems from the reverse boundary checking of the count of PlcfLst records in the vGet8LstInfo function in prop8.c. This leads to out-of-buffer reads, allowing attackers to provide a specially...

Zou Jingli: ThinkLibrary for ThinkAdmin – Authorization Issues Vulnerability

Zou Jingli: The ThinkLibrary for ThinkAdmin versions 1.0.81 and earlier have an authorization issue vulnerability. This vulnerability stems from an insecure direct object reference in the admin/file.edit function. Non-super administrators who own that node can read or overwrite other...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version from 0.1.0 to 0.3.3 had vulnerabilities related to permission management and access control. These vulnerabilities stemmed from incorrect DBus policies in the lomiri-upload-manager component, allowing any user to read arbitrary files with root privilege...

FreeRDP buffer error vulnerability

Versions of FreeRDP from 3.30.0 to 3.32.0 contain a buffer error vulnerability. This vulnerability stems from improper handling of clipboard responses by the Windows client’s CliprdrStreamNew function. It involves a stack out-of-bounds read issue, allowing malicious RDP servers to trigger invalid...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 6, 7, and 8 have a buffer error vulnerability. This vulnerability stems from multiple migration data processing programs in spice-server using offsets provided by clients from the SPICEMSGCMIGRATEDATA message, without any boundary validation. This can allow...

Astra Linux – Vulnerability in binutils

Heap buffer overflow vulnerability in binutils’ readelf before version 2.40, caused by the displaydebugsection function in the readelf.c file...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSETMAX Dan Aloni reports: Due to commit 8cfb9015280d “NFS: Always provide aligned buffers to the RPC read layers” on the client, a read of 0xfff is aligned up to server rsize of 0x1000. As a...

Astra Linux – Vulnerability in Vim

Vim is an open-source command-line text editor. From version 9.2.0320 to 9.2.0679, a crafted undo or swap file could store a virtual-text property whose offset and length points outside the line’s property data. When Vim restores or displays such a line, it converts the offset into a pointer and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: zsmalloc: Fixed races between asynchronous zspage free operations and page migration. The asynchronous zspage free worker attempts to lock the entire page list of a zspage, without protecting against page migration. Since page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdkfd: Fixed the lock dependency warning with srcu ====================================================== WARNING: A circular locking dependency was detected. 6.5.0-kfd-yangp 2289 Not tainted...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copyfromkernelnofault to read from unsafe address Reading from an unsafe address using copyfromkernelnofault in archadjustkprobeaddr occurs because this function is invoked prior to verifying whether the address ...

Astra Linux – vulnerability in openjdk-11

A vulnerability exists in the Oracle Java SE and Oracle GraalVM Enterprise Edition products under Oracle Java SE component: JAXP. Affected versions include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability...

Astra Linux – vulnerability in sane-backends

A NULL pointer dereference in saneiepsonnetread within SANE backends prior to version 1.0.30 enables a malicious device on the same local network as the victim to trigger a denial of service, known as GHSL-2020-075...

Astra Linux – Vulnerability in curl

There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...