Vanus-Labs Vanus authorization issue vulnerability

In the versions of Vanus-Labs’ Vanus from 0.8.0 to 0.9.0, there is an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in the gateway, allowing any authenticated user to call methods such as Subscribe, Ack, and unregistered methods without proper...

OpenTelemetry - CNCF OpenTelemetry Python encryption issue vulnerability

OpenTelemetry – CNCF OpenTelemetry has a security vulnerability in versions 1.5.0 to 1.45.0 of the Python library. This vulnerability stems from improper certificate verification. When the OTELEXPORTEROTLPCERTIFICATE variable is an empty string, TLS verification is disabled, allowing...

Ryan C. Gordon smpeg – Numerical error vulnerability

Ryan C. Gordon’s MPEG2.0.0 and earlier versions have a numerical error vulnerability. This vulnerability stems from an integer underflow in the streamheader function of MPEGsystem.cpp, which allows packetsize to wrap around by declaring a packet length that is too small. Attackers can provide...

Mzanzi Open Source Solutions Schroedinger buffer error vulnerability

Mzanzi Open Source Solutions’ schroedinger 1.0.11 and earlier versions contain a buffer error vulnerability. This vulnerability arises from the lack of validation for wavelet filter indices or transformation depth values, which may lead to out-of-bounds reading of static quantization tables...

Ryan C. Gordon’s smpeg buffer error vulnerability

Ryan C. Gordon’s MPEG.2.0.0 and earlier versions have a buffer error vulnerability. This vulnerability stems from the MPEGsystem::FillBuffer function, which handles special system header streams by performing heap out-of-bounds reads. An attacker can provide an MPEG file with the high-order bits ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.36 has a security vulnerability. This vulnerability stems from the lack of a memory barrier between the anonvma initialization and the vma-anonvma release. This may lead to the reuse of anonvma after its root is released, causing abnormal lock states and task suspensi...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.7 contains a security vulnerability. This vulnerability arises from the drm/nouveau component, where when the nvifoutpedidget function fails, nouveauconnectordetect returns early. As a result, the runtime PM reference acquired at the beginning of the function is not...

Vita3K path traversal vulnerability

Vita3K has a path traversal vulnerability. This vulnerability stems from a path traversal Zip Slip issue in the installarchivecontent function. Attackers can write files outside of the installation directory using the “..” path segment or absolute paths within a specially crafted.vpk compressed...

Netcore NR256CN Authorization Issue Vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have an authorization issue vulnerability. This vulnerability stems from an unvalidated file writing vulnerability in the /bin/boa web server, derived from Boa. Attackers can send POST requests to non-existent .cgi paths, thereby writing...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.29 has a security vulnerability. This vulnerability stems from the fact that the Data-In branch of iscsitcphdrdissect does not check the data direction. As a result, data provided by the target may be written into the page that the initiator is about to send, causing...

WordPress Strong Testimonials: Deserialization Injection Vulnerability

WordPress versions 3.3.12 and earlier have a deserialization vulnerability. This vulnerability stems from deserializing untrusted data, which may lead to object injection attacks...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities arise from a failure in the payload page pool allocation process. During this process, the cleanup path passes an incorrect pointer to pagepooldestroy, instead of destroying the header page pool. This can lead ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.9 contains security vulnerabilities. These vulnerabilities stem from the confusion between virtual and physical addresses, along with the absence of the virttodma64 conversion. This may lead to the firmware using the wrong address when measuring data on storage expansio...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.2 contains security vulnerabilities. These vulnerabilities stem from the use of NULL pmuctx in the perfpmuschedtask function, which may lead to undefined behavior due to null pointer dereferencing in the kernel...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel from 6.18.19 to 6.18.55, as well as versions from 6.19.9 to 6.20, and 7.0, contain security vulnerabilities. These vulnerabilities stem from schedext incorrectly setting the merge-queue flag to SCXRQINWAKEUP. This causes delayed scheduling requests to remain active ev...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from the index used by blkrevalidatezoneCond, which is derived from the reportzones function in the device driver. This index does not verify the size of the zonescond array. When the number of regions...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.16 contains a security vulnerability. This vulnerability arises from the fact that the KVM’s SEV mechanism does not perform cache maintenance on the source virtual machine during the migration of the host. As a result, outdated data remains in the CPU cache after the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.19 contains a security vulnerability. This vulnerability stems from the fixhostownership function in KVM arm64, which only iterates through the linear mapping aliases of each memblock area, without iterating through the VA range of each CPU’s hypervisor stack. This may...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.15 contains security vulnerabilities. These vulnerabilities stem from improper sequencing of canceling wdtwork and releasing WDT IRQ. As a result, the watchdog interrupt may reschedule tasks and access memory that has been released, leading to reuse of freed resources...

Omnigent path traversal vulnerability

In versions prior to Omnigent 0.14.0 and 0.3.0, there was a path traversal vulnerability. This vulnerability stems from path traversal attacks. Certified users can escape the working directory by setting up nested sub-proxies in os.env.cwd. They can also upload bundles that utilize absolute or...

Strophe/Libstrophe buffer error vulnerability

Strophe libstrophe versions 0.14.0 and earlier have a buffer overflow vulnerability. This vulnerability stems from SCRAMHi’s handling of SCRAM salts, where a stack buffer overflow occurs when processing SCRAM salts. Malicious XMPP servers can exploit this vulnerability by sending SCRAM salts that...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.9 contains a security vulnerability. This vulnerability arises from binding the IRQ requests managed by the devres group and devm to the embedded struct device within each copied port altredacdevicedev, rather than to the actual parent device device-edac-dev. As a resul...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.0 contains a security vulnerability, which stems from the lack of range checks on doprocintconvmsjiffiesminmax...

WordPress OttoKit: Permissions, licensing, and access control issues

WordPress OttoKit versions 1.1.40 and earlier have vulnerabilities related to permission granting and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

FreeRDP has a numerical error vulnerability

FreeRDP versions from 3.14.1 to 3.32.0 contain a numerical error vulnerability. This vulnerability stems from an integer underflow in the WinPR BMP writer. When the step size calculation does not match, the value SIZEMAX - 3 is passed to the StreamZero processing for sub-byte image handling...

Coder side-channel information leakage vulnerability

Versions of Coder prior to 2.29.17, 2.32.7, 2.30.0 prior to 2.33.0, 2.33.0 prior to 2.33.8, and 2.34.0 prior to 2.34.2 have a side-channel information leakage vulnerability. This vulnerability stems from the use of a placeholder hash derived from the string “hunter2” by the userpassword.Compare...

Admidio authorization issue vulnerability

Admidio versions 5.0.0 to 5.0.16 have a vulnerability related to authorization issues. This vulnerability stems from the omission of the pdfl parameter in the groupsrolesexport check in modules/groups-roles/listsshow.php. As a result, authenticated users with list viewing permissions can bypass t...

FreeRDP buffer error vulnerability

FreeRDP versions from 2.0.0 to 3.32.0 contain a buffer error vulnerability. This vulnerability arises from the server’s hash-callback NTLM path not verifying the MIC offset, allowing for out-of-bounds write attacks. Unauthenticated attackers can send a specially crafted AUTHENTICATEMESSAGE, writi...

Coder Authorization Issue Vulnerabilities

The Coder version 2.30.0 to 2.34.8 had an authorization issue vulnerability. This vulnerability stemmed from the DownloadFile gRPC handler in the provisioner daemon, which allowed unauthorized access. As a result, the authenticated provisioner daemon could download Terraform module archives store...

Coder input validation error vulnerability

Versions of Coder 2.3.1 to 2.14.4, 2.15.x versions before 2.15.3, and 2.16.0 to 2.16.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper cleaning of the redirect query parameters on the login page. It may lead to open redirection attacks. Attackers...

Admidio authorization issue vulnerability

The Admidio versions from 5.0.0 to 5.0.16 have a vulnerability related to authorization. This vulnerability stems from an insecure direct object reference in the ForumService::saveTopic method. It allows authenticated members to replace the topicuuid parameter in the topicsave request and reuse t...

ExtendThemes Image Hub information leakage vulnerability

The extendthemes Image Hub version 1.2.0 and earlier have a vulnerability involving information leakage. This vulnerability stems from the exposure of sensitive information. The vulnerabilities occur when plaintext API credentials for six third-party services are output into the HTML of each...

Actual WPeMatico RSS Feed Fetcher Cross-Site Script Vulnerability

The etruel WPeMatico RSS Feed Fetcher 2.9 and earlier versions had a cross-site scripting vulnerability. This vulnerability occurred because the plugin removed the WordPress wpfilterpostkses filter before calling wpinsertpost. Additionally, the imported RSS content was stored without any...

Blair Jersyer NexoPOS authorization issue vulnerability

Blair Jersyer NexoPOS versions 6.2.4 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication in the/api/fields/resource/identifier API. Unverified attackers can access transaction field classes such as nsentity-transaction, and use sequentia...

Checkmk Input Validation Vulnerability

Versions of Checkmk prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 contain a vulnerability related to input validation errors. This vulnerability stems from improper validation of the reseturl parameter during the Setup page. It may allow attackers to trick users into opening a specially crafte...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

IBM i race condition bug

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities due to race condition issues. These vulnerabilities stem from the Digital Certificate Manager DCM for System TLS, which causes a denial-of-service issue when applications attempt to establish secure network connections. This can result...

DeepSeek Harness: Permissions and access control issues

The DeepSeek Harness c291e796 version has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from an untrusted search path, which may allow attackers to execute arbitrary code by providing and executing a specially crafted executable file instead of...

FreeRTOS-FreeRTOS Kernel Buffer Error Vulnerability

FreeRTOS’s FreeRTOS-Kernel versions 11.3.0 and 11.3.1 contain security vulnerabilities. These vulnerabilities stem from the buffer length truncation during the MPU buffer authorization check in the Arm Cortex-R82 Armv8-R AArch64 MPU port. This issue may allow non-privileged tasks to read from or...

WordPress 10Web Booster has a path traversal vulnerability

WordPress 10Web Booster versions 2.34.5 and earlier have a path traversal vulnerability. This vulnerability arises from path traversal attacks, as the OptimizerWebPageCache::getcachefiledir function appends unclean $GET parameter names and values to the disk cache path. Additionally, the...

APIPark Authorization Issue Vulnerability

APIPark 1.9.7-beta and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Certified team administrators can access other teams’ services and applications by providing their own team ID in the team query parameter. This may...

IBM i Permission Licensing and Access Control Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from a lack of subtree checks during file handle parsing, which may allow local attackers to obtain sensitive information...

Kuaifan Dootask Authorization Issue Vulnerability

Kuaifan DooTask versions 1.9.66 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification in WebSocketDialog::checkDialog. It skips the membership checks for dialog boxes with grouptype set to 'okr'. Certified users can exploit this...

FreeRDP buffer error vulnerability

Versions of FreeRDP from 3.30.0 to 3.32.0 contain a buffer error vulnerability. This vulnerability stems from improper handling of clipboard responses by the Windows client’s CliprdrStreamNew function. It involves a stack out-of-bounds read issue, allowing malicious RDP servers to trigger invalid...

10up Distributor authorization issue vulnerability

The 10up Distributor versions prior to 2.3.2 have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification, allowing contributor-level users to call external AJAX operations that should be used by manageoptions users. Attackers can use...

FasterXML Jackson-core resource management vulnerability

FasterXML Jackson-core versions prior to 2.16.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, and 3.2.0 through 3.2.2 contain a resource management vulnerability. This vulnerability arises from the character input parser failing to apply the maxNameLength lim...

CodeWithCJ SparkyFitness command injection vulnerability

Versions of CodeWithCJ SparkyFitness prior to 1.6.0 have a command injection vulnerability. This vulnerability arises from the API/admin/backup/restore endpoints interpolating the names of uploaded files into shell commands. Certified global administrators can upload recovery archives whose file...

FreeRTOS FreeRTOS-Plus-TCP Authorization Issues Vulnerability

FreeRTOS and FreeRTOS-Plus-TCP versions prior to 4.4.2 have a licensing-related vulnerability. This vulnerability stems from improper verification of the source of communication channels by the IPv6 Router Advertisement handler. It may allow remote third parties to influence the endpoint’s IPv6...

Cassio Santos Whaticket Open Source Authorization Issue Vulnerability

Cassio Santos: Whaticket Open Source versions from cf04795 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references IDOR. ShowTicketService does not perform ownership or queue checks. Attackers can use the ticket IDs of other agents to...

Lenovo Smart Camera C33 encryption issue vulnerability

Versions of the Lenovo Smart Camera C33 prior to 05.02.31.140 have a security vulnerability related to improper certificate verification. This vulnerability may cause adjacent users to intercept or manipulate network communications...