CVE Vulnerability Catalog

An authentication bypass using an alternate path or channel in Johnson Controls EasyIO Neo EC and CW Edge Controller. The issue affects EC 3.3b62 through 3.3b63 and CW 3.3b24 through CW 3.3b25.

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers controlling the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

A vulnerability was identified in the Welcart e-Commerce plugin for WordPress up to 2.12.6, affecting the ESCOTT_MAIN::error_page_message function in classes/paymentESCOTT.main.class.php. Manipulation of the ResponseCd argument leads to cross-site scripting, the attack can be launched remotely, and the exploit is publicly available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority; no vulnerability description is available.

The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.

A flaw was found in hivex where a specially crafted Windows registry hive file can trigger an out-of-bounds memory read when parsing registry values containing malformed large data block lists. This can cause the application processing the registry file to crash.

Temporal Server includes a Worker Controller Instance module (go.temporal.io/auto-scaled-workers) that registers a 'k8s' compute provider which builds its Kubernetes client from the caller's request configuration rather than operator configuration. An authenticated caller with only read access in a single namespace can invoke ValidateWorkerDeploymentVersionComputeConfig, leading to arbitrary command execution on the Worker Service host under the server process account. Since the process holds persistence credentials for all namespaces and cluster TLS material, the impact extends beyond the caller's namespace to the entire cluster.

Improper limitation of a pathname to a restricted directory exists in the deployment status component of AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1. Through directory traversal sequences or an absolute path in the project name input, an attacker may read or, if write access is enabled, create/overwrite JSON files outside the intended directory.

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer.

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source.

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

An unprivileged application can exploit a lack of package/signature validation in SystemUI's RemoteQCController when resolving a hardcoded content:// URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weak_ptr within EvsEnumerator::openCamera(). Specifically, concurrent calls from a privileged UID (e.g., AID_AUTOMOTIVE_EVS) can cause a torn weak_ptr state, leading to a virtual call through a freed object's vtable at cameraObj->getCameraInfo(&desc). This allows for potential arbitrary code execution within the hal_evs_default process.

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a buffer_handle_t while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.

The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unordered_map. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially enabling code execution within the privileged HAL process.

The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

An unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.

The ClusterRenderingService.dump() method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAY_DISPLAY_DEVICES, an operation normally requiring android.permission.WRITE_SECURE_SETTINGS, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.