CVE Vulnerability Catalog

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

A vulnerability in Keycloak allows a user with high privileges to read sensitive information from a Vault file outside the expected context. The attacker must have prior high access to the Keycloak server, for example, to configure an LDAP provider and set up a Vault file read, which only reveals whether the file exists.

The Hathway Skyworth CM5100-511 router version 4.1.1.24 stores sensitive information about USB and Wi-Fi connected devices in plaintext. This means anyone with access to the router's storage can read this data.

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call returns a floating-point value and this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents, impacting confidentiality. The issue is specific to code generated using LLVM-based compilers.

Mattermost versions 9.11.X <= 9.11.1 and 9.5.x <= 9.5.9 incorrectly issues two sessions when using desktop SSO — one in the browser and one in the desktop app with incorrect settings.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change. rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing a possible circular locking dependency.

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, allowing an attacker to send a non-string value as the message of a permalink post and crash the frontend.

The vulnerability in RELY-PCIe versions v22.2.1 to v23.1.0 fails to set the Secure attribute for sensitive cookies in HTTPS sessions. This could cause the user agent to send those cookies in cleartext over an unencrypted HTTP session.

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to APDUs during card enrollment using pkcs15-init may lead to out-of-bounds access, potentially allowing arbitrary code execution.

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs, leading to incorrect access to initialized parts of the buffer when buffers are partially filled with data.

A vulnerability was found in pkcs15-init in OpenSC due to insufficient or missing checking of return values of functions. An attacker could use a crafted USB device or smart card presenting specially crafted APDU responses, leading to the use of uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient checking of function return values. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses, leading to work with uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient control of the response APDU buffer and its length during card communication. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses.

In OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK, there is a missing initialization of variables that are expected to be initialized before being used as arguments to other functions. This can lead to unpredictable behavior or potential security issues.

Vulnerability in Secure Systems Engineering Connaisseur up to 3.3.0, affecting unknown code in connaisseur/res/targets_schema.json of the Delegation Name Handler component, leading to inefficient regular expression complexity. The attack is difficult to exploit.

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to properly restrict channel creation, allowing a malicious remote to create arbitrary channels when shared channels are enabled.

In the Linux kernel, a vulnerability was resolved in s390/pkey that left copies of protected and secure keys on the stack. Although the clear key of neither protected nor secure keys is accessible, this key material should only be visible to the calling process, so all copies should be wiped from the stack, even in case of an error.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.