CVE Vulnerability Catalog

A vulnerability in BFD (Bidirectional Forwarding Detection) configured in static and dynamic routing protocols causes undisclosed traffic to stop BFD packet processing by the Traffic Management Microkernel (TMM). This leads to a failover of the configured routing protocol.

A path injection vulnerability exists in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a). The binary compiled from glue_generator.cpp does not validate file path parameters from the command line, allowing an attacker to read arbitrary files.

When BIG-IP DNS is provisioned, a vulnerability in the gtm_add and bigip_add iControl REST commands returns the ssh-password parameter in cleartext in the REST response and logs it in the audit log. This allows a highly privileged, authenticated attacker with audit log access to view sensitive information.

In Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint. It allows an authenticated attacker with administrator role privileges to cross a security boundary and delete files.

In AutoGPT before version 0.6.32, there is no limit on container log size, which can lead to disk resource exhaustion and DoS when user access is high. The issue is fixed in autogpt-platform-beta-v0.6.32.

NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the mod_para parameter in the woal_init_module_param function.

Buffer Overflow vulnerability in ArduPilot Copter latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_SmartAudio::loop, AP_SmartAudio, AP_SmartAudio.cpp components.

Buffer Overflow vulnerability in ArduPilot Copter latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_MSP::loop, AP_MSP, AP_MSP.cpp components.

A heap out-of-bounds read vulnerability in Crypt::Argon2 versions 0.017 before 0.031 for Perl occurs in argon2_verify on empty encoded input. The auto-detect form passes encoded_len - 1 to memchr without checking for zero, causing a size_t underflow and scanning adjacent heap memory.

ELECOM wireless LAN access point devices implement a CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked into performing unintended operations.

ELECOM wireless LAN access point devices do not check if the language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators inputs malicious data, an arbitrary script may be executed in another administrative user's web browser.

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper with the configuration file, and a victim administrator may be tricked into using a crafted configuration file.

After successfully transferring through a specific HTTP proxy (proxyA) with Digest authentication, changing the proxy host to a second one (proxyB) for a second transfer while reusing the same handle causes libcurl to wrongly pass the Proxy-Authorization header meant for proxyA to proxyB.

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when: 1. curl is set up to use different proxies for different URL schemes, 2. the first proxy needs credentials, 3. the second proxy uses no credentials, 4. while using the first proxy (e.g., http://), curl is asked to follow a redirect to a URL using another scheme (e.g., https://), accessed via a second, different proxy.

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. A logical error in the code causes a request to wrongfully reuse an existing connection authenticated with different credentials.

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to the same host bypasses the TLS requirement and transmits data unencrypted.

The newly introduced RecordUsage D-Bus method in malcontent-timerd allows arbitrary users on the system to slowly fill up disk space in /var/lib/malcontent-timerd.

csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU-style attacks on the temporary directories.