CVE Vulnerability Catalog

In Fortinet FortiOS versions 7.4.0 to 7.4.8, 7.2, 7.0, and 6.4, passwords are stored in a recoverable format. This allows an attacker to disclose information by modifying the LDAP server IP to point to a malicious server.

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can write memory beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and is a large string (e.g., 2MB or more), an integer overflow occurs when calculating the result buffer size, so malloc may not allocate enough memory.

A flaw was found in GLib where an integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

A vulnerability has been found in GNU Binutils 2.43/2.44 in the function display_info of the file binutils/bucomm.c of the objdump component. The manipulation leads to memory leak. The attack requires local access, and the exploit has been publicly disclosed.

go-redis, the official Redis client library for the Go programming language, prior to 9.5.5, 9.6.3, and 9.7.2, potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag `DisableIndentity` to `true` when constructing the client instance.

A vulnerability in the port ACL functionality of AOS-CX software on HPE Aruba Networking CX 9300 Switch Series. Affects AOS-CX 10.14.xxxx (all patches) and 10.15.1000 and below. An attacker can bypass ACL rules applied to routed ports on egress, leading to unauthorized traffic flow and security policy violations. Egress VLAN ACLs and Routed VLAN ACLs are not affected.

Android apps can load web pages using the Custom Tabs feature. This feature supported a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.

During address list folding, when a separating comma ends up on a folded line and that line is to be unicode-encoded, the separator itself is also unicode-encoded instead of remaining a plain comma. This can cause some mail servers to misinterpret the address header.

Mattermost versions 9.11.x <= 9.11.6 and 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot. This allows the converted user to escalate their privileges depending on the permissions granted to the bot.

W bibliotece GNU elfutils 0.192 zidentyfikowano podatność w funkcji elf_strptr, która może prowadzić do odmowy usługi. Atak można przeprowadzić na lokalnym hoście, jednak jego złożoność jest dość wysoka, co utrudnia wykorzystanie podatności.

In the CPython standard library module 'mimetypes', on Windows the default list of known file locations is writable, meaning other users can create invalid files to cause MemoryError on Python runtime startup or have file extensions interpreted as the incorrect file type. This defect is caused by default locations from Linux and macOS platforms (such as '/etc/mime.types') also being used on Windows, where they are user-writable locations ('C:\etc\mime.types').

In GNU Binutils 2.43, the xstrdup function in xstrdup.c of the ld component causes a memory leak. The attack can be launched remotely but has high complexity and is difficult to exploit. The exploit has been publicly disclosed and may be used.

In curl, when a .netrc file is used for credentials and HTTP redirects are followed, the password used for the first host can be leaked to the followed-to host under certain circumstances. The flaw only manifests if the netrc file has a 'default' entry that omits both login and password.

An out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15 allows an attacker to trigger a denial of service via specially crafted packets.

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, allowing team admins without invite permission to invite users by updating the "allow_open_invite" field and making their team public.

Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, causing confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been bypassed. This vulnerability was fixed in Firefox 134.

W podatności CVE-2024-12970 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach systemu operacyjnego, co pozwala na wstrzyknięcie poleceń systemowych w aplikacji My Computer w systemie Pardus OS. Problem dotyczy wersji przed 0.7.2.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).