CVE Vulnerability Catalog

Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allow authenticated attackers with low-level privileges to access other users' information via a crafted API request.

A vulnerability was found in the Linux kernel's ip6gre_header() function in the ip6_gre driver. The bug causes a kernel panic (kernel BUG) due to insufficient skb headroom, which can be exploited by an attacker to crash the system.

A reference count leak was discovered in the Linux kernel when deleting nexthop objects for IPv4 error routes (e.g., blackhole). Error routes were not flushed with the dead nexthop, keeping references on the nexthop object and device, preventing their release.

In the Linux kernel RDMA/core subsystem, a validation flaw exists in the netlink response handling for RDMA_NL_LS_OP_IP_RESOLVE. When userspace does not provide the LS_NLA_TYPE_DGID attribute, the kernel performs an uninitialized stack read, triggering a KMSAN error. The vulnerability is fixed by properly using nla_parse_deprecated() and directly checking for the DGID attribute.

In the Linux kernel, the net: usb: asix driver reads the PHY address from the USB device without validation. A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), triggering a warning in mdiobus_get_phy().

A race condition in the Linux kernel's MPTCP implementation during simultaneous connection setup leads to an inconsistent fallback status, triggering a WARNING and potential system crash.

In the Linux kernel, the iavf_config_rss_reg() function in the iavf driver has off-by-one bugs when configuring the RSS hash key and lookup table. The loop condition uses '<=' instead of '<', causing out-of-bounds memory reads (detected by KASAN) and out-of-bounds writes to device registers.

In the Linux kernel, RDMA/cm leaks a multicast GID table reference when the CM ID is destroyed while the multicast creation CM event is still queued. cancel_work_sync() prevents the work from running, so ah_attr is not destroyed, leaking a refcount and triggering a warning.

In the Linux kernel, drm/ttm can dereference a NULL pointer for evicted buffer objects (BOs). When devcoredump tries to read the contents of all BOs, a BO without an associated resource can cause a NULL pointer dereference.

A deadlock was discovered in the Linux kernel between nfc_unregister_device and rfkill_fop_write due to inverted lock ordering of device_lock and rfkill_global_mutex, causing thread blockage.

W jądrze systemu Linux zidentyfikowano podatność związaną z brakiem ograniczenia liczby banków PCR w funkcji tpm2_get_pcr_allocation(). Wprowadzono ograniczenie do ośmiu banków, aby zminimalizować potencjalne szkody wynikające z wartości poza zakresem pochodzących z zewnętrznego I/O.

In the Linux kernel, the drm/xe/oa driver did not validate num_syncs in the OA open parameters. This allowed userspace to pass arbitrarily large values, potentially leading to excessive allocations.

W jądrze systemu Linux zidentyfikowano podatność, która prowadziła do zakleszczenia podczas odczytu tabeli partycji z urządzenia blokowego ublk. Problem występował, gdy proces próbował uzyskać dostęp do urządzenia blokowego, co prowadziło do sytuacji, w której ten sam proces czekał na mutex, który już posiadał.

The Vanilla OS 2 Core image v1.1.0 from fabricators Ltd was found to contain static SSH keys, allowing attackers to perform a man-in-the-middle attack during connections with other hosts.

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response with Access-Control-Allow-Credentials: true. This enables malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me, exposing sensitive user session data.

A stack-based buffer overflow vulnerability in the mcp2200gpio utility in TinyOS versions up to and including 2.1.2. It is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.

Prior to 1.8.5, Fulcio's metaRegex() function uses an unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. The SSRF can only trigger GET requests, cannot mutate state, and the response is not returned, so only blind SSRF is possible.

The D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition.

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref entries when rebuilding the cross-reference table, especially for PDF files with lots of whitespace characters. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.