CVE Vulnerability Catalog

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate error messages displayed by the application.

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagated permissions into namespaces of downstream clusters without privilege-escalation validation, potentially allowing a non-administrative user to gain excessive permissions.

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates response bodies with gzip, x-gzip, or deflate Content-Encoding without a size limit, potentially exhausting client memory.

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack in Nut/OS (Ethernut/Egnite) up to version 5.1. An unauthenticated attacker can send a single TCP segment with an unknown option with a zero length byte, triggering an infinite loop in NutTcpInputOptions and blocking the TCP processing thread.

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read tables accessible to a more privileged principal and write to the table that principal is updating via a crafted column name.

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, leading to an ogs_assert(new) failure in ogs_pfcp_xact_receive() and termination of the network function process with SIGABRT.

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released, and repeated failures can exhaust the UE IP address pool.

A stack-based buffer overflow exists in the ims_qos_npn module of Kamailio v6.1.3 and v6.1.4. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

A stack-based buffer overflow exists in the ims_registrar_pcscf module of Kamailio v6.1.3 and v6.1.4. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. This is due to an unanchored regular expression in the ACR credential helper that accepts hostnames containing .azurecr.io, .azurecr.cn, .azurecr.de, or .azurecr.us.

In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.

In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.

In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.

A TOCTOU race in the Linux kernel Bluetooth L2CAP subsystem allowed an l2cap_chan to be linked to an l2cap_conn more than once, violating an invariant assumed during cleanup. The fix adds an invariant check in __l2cap_chan_add and a l2cap_lock_chan guard in l2cap_sock_bind().

A use-after-free in the Linux kernel tracing subsystem: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock, while a concurrent rmdir of an instance removes and frees it under that lock. A module load or unload can therefore walk into a freed trace_array.

A double-free/use-after-free in the Linux kernel tracing subsystem: update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

In the Linux kernel tracing subsystem, a failed hist command that creates a field variable histogram leaves a registered trigger without a corresponding entry in field_var_hists[]. As a result, the trigger remains active and keeps counting even though the operation failed with -EINVAL, causing a resource leak and inconsistent state.