CVE Vulnerability Catalog

A vulnerability in the GNU C Library (glibc) versions 2.34 through 2.43 causes calls to gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf specifying the DNS backend to return an invalid DNS hostname, violating the DNS specification.

An XSS vulnerability in SyncFusion 30.1.37 allows injection of malicious JavaScript code via the Document-Editor reply to comment field and the Chat-UI chat message.

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. A remote attacker with an administrator account can exploit this vulnerability to bypass security mechanisms or read application data.

A vulnerability in Traefik allows bypassing mutual TLS (mTLS) authentication by sending a fragmented ClientHello packet. When SNI extraction fails due to fragmentation, the TCP router falls back to the default TLS configuration, which does not require client certificates.

In pypdf versions prior to 6.9.1, an attacker can craft a malicious PDF that causes long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue is fixed in version 6.9.1.

Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite allows Object Injection. This issue affects TotalContest Lite from n/a through 2.9.1.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the TEQL (Trivial Equalizer) network scheduler. The teql_master_xmit() function fails to update skb->dev before calling netdev_start_xmit(), causing gretap tunnels to use the wrong master device teql0 which lacks allocated tstats, resulting in a page fault.

In the Linux kernel, tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lacked their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. A lower recursion limit (4) and recursion detection were added to iptunnel_xmit() and ip6tunnel_xmit().

Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead to Denial of Service via Excessive Allocation (CAPEC-130).

A flaw was found in libarchive related to undefined behavior in the zisofs decompression logic, caused by improper validation of the `pz_log2_bs` field read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file, leading to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

A reflected XSS vulnerability in the Location Aware Sensor System by Linkit ONE (up to commit f06bd20, 2023-04-26) exists in the PM25.php file. Attackers can inject malicious JavaScript into GET parameters (site, city, district, channel, apikey), leading to script execution in victims' browsers.

An integer underflow flaw was found in libsoup when processing content with a zero-length resource, leading to a buffer overread. This may allow an attacker to access sensitive information or cause an application-level denial of service.

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects applications using the reconfirmable option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the confirmation_token and unconfirmed_email fields, so the token is sent to the attacker's email while unconfirmed_email points to the victim; using the token confirms the victim's email on the attacker's account. Patched in version 5.0.3.

W jądrze systemu Linux rozwiązano problem z niespójnością flagi IS_CHECKPOINTED, który występował podczas równoczesnych operacji zapisu atomowego i checkpointu w systemie plików F2FS. Problem objawiał się błędem -EINVAL podczas montowania F2FS w określonych warunkach wielowątkowych.

W jądrze systemu Linux zidentyfikowano podatność w kodzie arbitrażu RIVA NV3, która może prowadzić do błędu dzielenia przez zero. Atakujący może skonstruować złośliwe urządzenie, które ustawia parametr state->mclk_khz na zero, co powoduje awarię jądra podczas obliczeń związanych z arbitrażem.

W jądrze Linuxa rozwiązano podatność polegającą na błędnym zastosowaniu commit'u dotyczącego sprawdzania, czy ASPM jest włączone w subsystemie PCIe. Powodowało to trudne do zdiagnozowania awarie w systemach z dwoma kartami graficznymi AMD, z których tylko jedna obsługiwała ASPM.

In the Linux kernel, the nvme-fc driver's nvme_fc_init_ctrl() fails to release the admin tagset when controller initialization fails after a successful nvme_add_ctrl(). This leads to leaked blk-mq allocations.

W jądrze systemu Linux zidentyfikowano podatność związaną z funkcją mas_store_gfp(), która może prowadzić do wycieku pamięci. W przypadku niepowodzenia alokacji nowego bloku ('entry'), blok ten pozostaje przydzielony i nie jest zwalniany.