CVE Vulnerability Catalog

Funkcja 'Long Term Retention' (LTR) w IBM Guardium Data Protection w wersjach 12.2.1 i 12.2.2 może ujawniać wrażliwe dane uwierzytelniające w trybie debugowania. To stwarza ryzyko nieautoryzowanego dostępu do poufnych informacji.

IBM OPENBMC w wersjach FW1110.00 do FW1110.11 jest podatny na ataki typu denial of service (DoS) ze strony nieautoryzowanych użytkowników sieciowych.

IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query. This may allow unauthorized access to upload operations.

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language Environment (ILE) compiler. An authenticated attacker could exploit this by compiling specially crafted source code containing a specific combination of statements.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 is vulnerable to a denial of service. The flaw occurs when a specially crafted query is run against range partitioned tables.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables. This may lead to a denial of service.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.

IBM WebSphere Application Server - Liberty w wersjach od 22.0.0.11 do 26.0.0.5 może umożliwić zdalnemu atakującemu obejście zabezpieczeń w określonych warunkach, wykorzystując specyficzny czasowy interwał.

IBM App Connect Enterprise w wersjach od 13.0.1.0 do 13.0.7.0 przechowuje potencjalnie wrażliwe informacje w plikach dziennika, które mogą być odczytane przez lokalnego użytkownika.

IBM WebSphere Application Server - Liberty w wersjach od 19.0.0.7 do 26.0.0.5 oraz IBM WebSphere Application Server w wersjach 9.0 i 8.5 są podatne na atak typu denial of service, spowodowany wysłaniem specjalnie przygotowanego żądania. Zdalny atakujący może wykorzystać tę podatność, aby spowodować zużycie zasobów pamięci serwera.

The WebToffee Product Import Export for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.5.6.

In libusb before version 1.0.30, a one-byte out-of-bounds read vulnerability exists in parse_iad_array() in descriptor.c. An attacker can supply a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size, leading to a read past the end of the malloc allocation.

In the Linux kernel, the can:ucan driver had a lifetime management issue where resources tied to the USB interface were not properly released upon driver unbind, causing memory leaks.

In the Linux kernel, a vulnerability was found in the netfilter module where bitwise shift operations (nft_bitwise) did not reject a zero shift operand. This led to undefined behavior in the carry propagation logic, potentially causing incorrect operation or security breaches.

In the Linux kernel's CAIF subsystem, a vulnerability exists where `caif_connect()` does not clear the client service pointer (`adap_layer->dn`) during teardown, leading to a use-after-free when the socket is destroyed.

In the Linux kernel, the tpm2_read_public() function is missing tpm_buf_destroy() calls on two exit paths, causing a page allocation leak. The issue occurs when name_size() returns an error (unrecognized hash algorithm) and on the success path.

In the Linux kernel, a vulnerability in the md/md-llbitmap module was found due to incorrect operation order: the barrier raise occurred after the state machine call, potentially causing race conditions. The fix moves the barrier raise before the state machine transition in llbitmap_start_write() and llbitmap_start_discard().

In the Linux kernel, a vulnerability was found in the rtw88 WiFi driver. The lack of checking for the existence of a PCI upstream bridge before using it can cause a crash during device initialization when the card is directly connected to the root bus. This primarily affects 8821CE cards in non-standard hardware configurations.

In the Linux kernel, the igorplugusb driver for infrared remote controls violates DMA coherency rules. The USB request structure may be subject to DMA on some host controllers, so it must be allocated separately to ensure memory coherency.

In the Linux kernel, a vulnerability in the zram driver causes partial discard operations to hang indefinitely. The issue is due to missing bio_endio() call after immediate request completion, leading to blkdiscard process freeze.