CVE Vulnerability Catalog

In Hulumi prior to version 1.4.0, drift detection in CI/cron could silently cache transient adapter failures as 'all clear', masking real attacks for up to six hours, or falsely escalate ordinary provider-version churn to incident severity.

In Hulumi prior to version 1.4.0, users of AccountFoundation could deploy an AWS account whose CloudTrail/Config audit logs were deletable by any S3-delete-capable principal, despite the startup-hardened tier guaranteeing tamper-resistance. Sandbox deployments had no audit immutability.

In Hulumi prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket.

In Hulumi prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name.

In Hulumi prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers.

In the service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE), the proxy appends impersonation headers without removing caller-supplied values. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

Pre-authentication heap buffer overflow in libssh2 up to 1.11.1, allowing a malicious SSH server to corrupt client heap metadata by sending a packet with packet_length smaller than cipher block size during Encrypt-then-MAC negotiation.

Missing bounds check in libssh2 up to 1.11.1, allowing a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and free of an uninitialized pointer via the publickey subsystem.

Pre-authentication integer underflow in ssh2_cipher_crypt() in libssh2 up to 1.11.1, allowing a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers.

Double-free vulnerability in sftp_open() in libssh2 up to 1.11.1, allowing a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session.

OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.

Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.

Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.

Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.

Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.

Suna before version 0.9.102 contains a broken access control vulnerability in the message queue API. Authenticated attackers can access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks.

Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.

In the Linux kernel iwlwifi driver, three BA session handlers used ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. WARN_ON_ONCE(!ba_data->sta_mask) guards were added before each ffs() call.

In the Linux kernel, a use-after-free vulnerability was found in the pwrseq subsystem's pwrseq_debugfs_seq_next() function. The issue stems from incorrect device reference counting, leading to use of freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the FPGA region subsystem's child_regions_with_firmware() function. Calling of_node_put(child_region) before the error message leads to accessing freed memory.