CVE Vulnerability Catalog

CloudNativePG before versions 1.28.4 and 1.29.2 opened superuser connections without pinning search_path, allowing a role with DATABASE OWNER to execute attacker-controlled functions as the postgres superuser, including OS command execution and access to the pod ServiceAccount token.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.

A vulnerability in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources to bypass security controls. The HelmRelease controller processes chart templates with elevated ServiceAccount privileges without proper validation, enabling deployment of arbitrary resources across the cluster.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.

A vulnerability in Lighthouse allows a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces. This occurs because the destination namespace is derived from an attacker-controlled label or annotation on the broker object.

A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.