CVE Vulnerability Catalog

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups "SuperUser", "Admin", or "Maintainer".

A race condition was found in rsync's handling of symbolic links. By default, rsync skips symbolic links, but an attacker can replace a regular file with a symbolic link at the right moment to bypass this behavior and traverse symbolic links.

A flaw in rsync causes the client to improperly verify symbolic link destinations when using the `--safe-links` option, allowing path traversal and arbitrary file write outside the intended directory.

A path traversal vulnerability was found in rsync, caused by the `--inc-recursive` option (enabled by default for many clients and can be forced by the server). Insufficient symlink verification combined with per-file-list deduplication checks allows a server to write files outside the client's intended destination directory.

A flaw was found in rsync that could allow a server to enumerate the contents of an arbitrary file from the client's machine. The issue occurs during file copy from client to server when the server sends checksums of local data for comparison. An attacker can send specially crafted checksum values and reconstruct the data byte-by-byte based on client responses.

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.

A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.

A vulnerability was found in Keycloak where admin users may access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admins can include placeholders like ${env.VARNAME} or ${PROPNAME}, which the server replaces with actual values during URL processing.

A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This is done by modifying security headers and inserting newlines, causing the server to write to a terminated request, leading to failure.

A vulnerability in Vim may lead to a heap-buffer overflow when switching to other buffers with visual mode still active. The issue arises from the improper ending of visual mode, which may result in attempts to access memory beyond the end of a line in a buffer.

MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.

In the Linux kernel, a vulnerability was fixed in the PCI imx6 driver where suspend/resume support was broken on the i.MX6QDL platform. Without the patch, suspend/resume would hang the kernel and display an error if a PCIe device was connected.

In the Linux kernel, the netfilter IDLETIMER module has a possible ABBA deadlock. Deletion of the last rule referencing an idletimer can occur simultaneously with a read of its sysfs file, causing a circular locking dependency. The fix frees list_mutex right after removing the element from the list, then continues teardown.

In the Linux kernel, cache_set_flush() may dereference a NULL c->root pointer because the check IS_ERR_OR_NULL was replaced with IS_ERR. This can lead to a NULL pointer dereference and potential system crash.

In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability was found causing a possible null pointer dereference in a logging function when called from request_lock(), as lkb->lkb_resource is not yet assigned. Additionally, a resource name could be a non-printable byte array, leading to incorrect ASCII assumption.

In the Linux kernel, a race condition exists in pinmux where two processes concurrently call pinctrl_select_state() for the same GPIO. Process B may read desc->mux_usecount updated by process A before desc->mux_owner is set, leading to a NULL pointer dereference and kernel crash.

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. Fixed in Firefox for iOS 134.

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134.

MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.

MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.