Illumos-Gate resource management error vulnerability

The illumos-gate vulnerability involves a resource management issue. This vulnerability stems from the switcher function in the nscd frontend code located at usr/src/cmd/nscd/nscdfrontend.c. This function does not properly close file descriptors that are passed through the doorcall function but a...

MynaParrot Plug-N-Meet – A scalable, customizable, open-source web conferencing system with path traversal vulnerabilities

MynaParrot Plug-N-Meet – A scalable, customizable, open-source web conferencing system. Versions 2.5.2 and earlier have a path traversal vulnerability. This vulnerability stems from a path traversal issue with the whiteboard conversion endpoint. Attackers can provide a /../ sequence, use a...

Posit Shiny for Python: Path traversal vulnerability

Posit Shiny for Python versions 1.4.0 to 1.6.4 had a path traversal vulnerability. This vulnerability stemmed from the bookmark restoration function’s acceptance of stateid provided by the client. The function did not verify whether it was a single secure path segment before appending it to the...

EIP Stack Group OpENER security vulnerability

EIP Stack Group OpENer v2.3 version contains a security vulnerability. This vulnerability stems from an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection path resolver, which could allow remote attackers to cause a denial-of-service attack...

ProcessMaker SQL Injection Vulnerability

Versions of ProcessMaker prior to 2026.14.3 have a SQL injection vulnerability. This vulnerability stems from the unvalidated orderby parameter in the GET /api/1.0/tasks endpoint. The orderby parameter is bound to user-controlled processrequests column names, which are used in the DB::raw SQL...

EIP Stack Group OpENER security vulnerability

EIP Stack Group OpENer v2.3.0 version contains a security vulnerability. This vulnerability arises from an out-of-bounds read in the unconnected explicit message path, which could be exploited by remote attackers to cause a denial-of-service attack...

EIP Stack Group OpENER Buffer Error Vulnerability

The EIP Stack Group OpENer has a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection path resolver, which could allow remote attackers to cause a denial of service attack...

EIP Stack Group OpENER security vulnerability

EIP Stack Group OpENer v2.3 version contains a security vulnerability. This vulnerability stems from an integer underflow in the server-side EtherNet/IP ForwardOpen connection path resolver, which may allow remote attackers to cause a denial-of-service attack...

OmniOs resource management error vulnerability

The OmniOs r151020 version and later versions, as well as SmartOS versions before the fix, have a resource management vulnerability. This vulnerability stems from the IP management daemon ipmgmtd releasing resources twice when making door requests to modify interface configurations. This can caus...

Warlee KodExplorer path traversal vulnerability

Versions of Warlee KodExplorer prior to 4.55 contained a path traversal vulnerability. This vulnerability stems from the path traversal in the unzipprename function. A single non-recursive strreplace cleanup operation can be exploited by specially crafted file names like “….//”. Combined with the...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has security vulnerabilities. These vulnerabilities stem from a failure to reject X.509 certificates that contain contradictory combinations of key usage KU and extended key usage EKU. This could allow attackers to obtain sensitive information...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has security vulnerabilities. These vulnerabilities arise from the rejection of legitimate CA certificates, which may lead to denial-of-service attacks...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has a security vulnerability. This vulnerability stems from improper certificate verification, causing the application to reject legitimate certificates of legitimate users, potentially leading to denial-of-service attacks...

Intego Antivirus’ backend link vulnerability

Intego Antivirus for Windows versions 3.0.0.1 and earlier have a post-release link vulnerability. This vulnerability stems from a link-following vulnerability in the optimization module. Attackers can replace the scanned duplicate file directories with junctions pointing to C:\Config.msi, and...

Splunk Enterprise: Permissions licensing and access control issues

Versions of Splunk Enterprise prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper access control mechanisms, which may allow unauthorized access...

Sungrow iSolarCloud authorization issue vulnerability

Sungrow iSolarCloud versions prior to 2026 have an authorization issue vulnerability. This vulnerability stems from the logintype parameter being set to 5 in the login request, leading to authentication bypass and account takeover, which could potentially cause local power outages in Europe...

Splunk Enterprise resource management error vulnerability

Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 have a resource management vulnerability caused by improper control of the resource lifecycle...

Splunk Enterprise processing logic error vulnerability

Versions of Splunk Enterprise prior to 10.4.3, 10.2.7 prior to version 10.2.7, 10.0.10 prior to version 10.0.0, and 9.4.15 prior to version 9.4.15 have a processing logic vulnerability that stems from a failure of the protection mechanism...

Foreman permission and access control vulnerabilities

Foreman has vulnerabilities related to permission checks and access control. These vulnerabilities stem from improper permission verification by the template preview endpoint. As a result, authenticated users with low-level Viewer permissions can submit requests to obtain sensitive data such as t...

Ali A. Saleem Anchorme.js Resource Management Error Vulnerability

Ali A. Saleem: Anchorme.js 3.0.8 and earlier versions have a resource management vulnerability. This vulnerability arises from catastrophic backtracking during the extraction of regular expressions from IPv6 hosts, which can lead to Regular Expression Denial-of-Service attacks. Attackers can...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability arises because when libsoup constructs WebSocket client frames for extremely large outbound payloads, the size value passed to the GByteArray allocation API may be truncated. However, the masking routine still uses the full...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability stems from libsoup’s failure to properly limit the total size of WebSocket messages when reassembling them into GByteArray objects. A remote attacker can send specially crafted fragments, leading to size truncation and ultimate...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer error vulnerability. This vulnerability arises from the handling of incoming WebSocket Pong frames. SoupWebsocketConnection sends the ::pong signal using a GByteArray pointer. Since this signal is declared to be passed as GBytes, processes that follow the GBytes API may...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability arises when the max-incoming-payload-size is set to infinity 0. In such cases, libsoup’s SoupWebsocketConnection will expand the incoming GByteArray based on the length of the frame controlled by the attacker. This can lead to ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.15 contains security vulnerabilities. These vulnerabilities arise from the failure to clean up the typec switch when detection fails, resulting in resource leaks for the typec switch...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains a security vulnerability. This vulnerability stems from the tc9563 driver in the PCI/pwrctrl subsystem, which incorrectly parses two physical functions when integrating the Ethernet MAC Endpoint node. As a result, access beyond the tc9563pwrctrl-cfg array is...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.7 contains a security vulnerability. This vulnerability stems from the lack of a read memory barrier in the retry mechanism for the rpcstatusget dumpit sequence count. On weakly ordered architectures, this could lead to CPU reordering of field reads, rendering the retry...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.3 contains a security vulnerability. This vulnerability stems from the fact that the svcauthgssdecodecredbody function in SURNPRPC does not reset the caller’s rpcgsswirecred at its entry point. As a result, residual state from previous requests remains after decoding...

GIMP buffer error vulnerability

GIMP has a buffer error vulnerability. This vulnerability arises from the fact that when processing specially crafted GIMPressionist preset files, GIMP plugins incorrectly validate vector indices before writing to fixed-size arrays. This can lead to out-of-bounds writes, memory corruption, and...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.12.35 to 6.12.109, 6.15.4 to 6.16, and 6.16 contain security vulnerabilities. These vulnerabilities stem from the fact that the function rvrdmardmaaccept fails to check rndone before calling rpcrdmarnunregister, resulting in an unbalanced reference count and...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.4 contains security vulnerabilities. These vulnerabilities arise from the use of the vxlanmdbFlush function, which iterates through MDB entries using hlistforeachentrySafe. Deleting one entry can trigger the deletion of another entry, leading to reclamation after releas...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.1 contains a security vulnerability. This vulnerability stems from the fact that RDMA/bnxtre verifies udata only after removing the driver resources. As a result, the destruction callback can still run again when the resources have been released, potentially leading to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.9 has a security vulnerability. This vulnerability arises from the function gbaudiogbgettopology, which retrieves topology data based on the sizes provided per module. However, the function gbaudiotplgparsedata does not verify whether the segment sizes of sizedais,...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.18.51 and 7.2.5 contain security vulnerabilities. These vulnerabilities stem from LoongArch’s undefined DIRECTMAPPHYSMEMEND, which allows for out-of-bounds searches in functions like getfreememregion and mhpgetpluggablerange. Additionally, vmemmappopulate m...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.16 contains a security vulnerability. This vulnerability stems from a loop in the ppldoflush function that continues iterating after calling ppliounitfinished, resulting in access to io-pendingflushes. This could lead to reuse of resources after they have been released...

GNU Emacs code injection vulnerability

GNU Emacs versions prior to 31.2 have a code injection vulnerability. This vulnerability arises from the Flymake mode, which, when using non-Lisp language backends, executes arbitrary code from the edited files during syntax checking. This could allow an attacker to execute arbitrary code with th...

Cockpit Files: Backlink Vulnerability

Cockpit Files has a postback link vulnerability. This vulnerability arises from Cockpit-Files’ improper handling of directories that contain symbolic links. Low-privilege local users can exploit the “Paste as owner” feature to change the ownership of files anywhere other than the intended...

Cockpit Files: Race Condition Issues

The Cockpit Files vulnerability involves a race condition issue. This issue arises due to a race condition occurring when the cockpit-files directory is created and its owner is assigned. Local, low-privilege attackers can exploit this by controlling the writable parent directory. By replacing th...

RESTEasy Resource Management Error Vulnerability

RESTEasy has a resource management vulnerability. This vulnerability stems from the fact that IIOImageProvider does not impose any restrictions on the declared image size or number of pixels when decoding image requests provided by attackers. This allows unauthenticated remote attackers to send...

RESTEasy security vulnerabilities

RESTEasy has a security vulnerability. This vulnerability stems from CorsFilter, which, when configured to allow all origins, reflects the Request-Origin header in the Access-Control-Allow-Origin response and allows credentials to be carried along. This can enable malicious websites to initiate...

Environment Module Command Injection Vulnerability

Environment modules have a command injection vulnerability. This vulnerability arises when a local attacker places a maliciously named modulefile in a visible location within the victim’s MODULEPATH. When the victim uses Bash completion for the module or the ml command, the malicious module name,...

GIMP numerical error vulnerability

GIMP has a numerical error vulnerability. This vulnerability arises from the file-psd plugin, which generates thumbnail previews of specially crafted PSD image files. During this process, integer overflow occurs due to the multiplication of embedded JPEG header values. This leads to insufficient...

GIMP buffer error vulnerability

GIMP has a buffer error vulnerability. This vulnerability stems from the Lighting Effects filter in GIMP, which fails to correctly verify the number of light sources when processing specially crafted lighting preset files. This can lead to out-of-bounds writes and memory corruption. Attackers can...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from a typo in the acpipccretrievebiosdata function, which allows for out-of-bounds writing to the pcc-sinf array, potentially leading to a stack overflow...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the asynchronous notifier failing to unregister and clean up erroneous paths, resulting in the notifier remaining linked in the global notifierlist. As a result, the ipu7isys structure is released, causing the linked lis...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the fact that ipmiaddsmi only removes the nrusers file when registration fails, but does not remove the nrmsgs file. As a result, the sysfs attributes of interfaces that have been released may remain registered...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from an error in the initiation of the IPMI interface; tasks that have been scheduled are not canceled before releasing the interface, potentially leading to reuse after release...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the fact that the dm-array does not validate the fields of the array block header structure during reading. As a result, out-of-bound reads of the dm-bufio buffer occur when the count exceeds the capacity of the block...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the bpfgetstack function in bpf, which does not disable preemption during the process of obtaining per-CPU callchain entries and copying them to the caller’s buffer. This allows other tasks on the same CPU to reuse this...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.17 contains security vulnerabilities. These vulnerabilities stem from the fact that tegra241vintfinitvsid does not verify the width of the SIDATCHECK field for the vSID provided by the guest. This may lead to values being truncated and matching to the wrong Stream ID...