CVE Vulnerability Catalog

In PcVue versions 15 through 15.2.2, a vulnerability allows insertion of sensitive information into log files. A user with access to these logs can discover connection strings for data sources configured for DbConnect, which may include credentials.

A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation results in a denial of service on the affected system.

Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive information can occur are complex and depend on factors beyond the control of attackers.

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition. A successful attacker can cause a system hang which can only be resolved via a power cycle.

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation results in the ability to delete arbitrary files on the underlying operating system.

Vulnerability in ArubaOS on 7xxx series controllers allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could lead to permanent modification of the underlying operating system.

Vulnerability in ArubaOS on 7xxx series controllers allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could lead to permanent modification of the underlying operating system.

Teleport versions v3.2.2, v3.5.6-rc6, and v3.6.3-b2 were found to have an information leak through the /user/get-role-list web interface. The vulnerability allows unauthorized users to access the list of roles.

In the Linux kernel's xen-netback driver, guests can trigger a deadlock when trying to free the SKB of a packet dropped due to XSA-392 handling. The same deadlock could occur when dropping packets for other reasons if netpoll is active for the interface.

In the Linux kernel's xen-netback driver, guests can trigger a deadlock when trying to free the SKB of a packet dropped due to XSA-392 handling. The same deadlock could occur when dropping packets for other reasons if netpoll is active for the interface.

curl can be told to parse a `.netrc` file for credentials. If that file ends in a line with 4095 consecutive non-white space letters and no newline, curl would first read past the end of the stack-based buffer, and if the read works, write a zero byte beyond its boundary. This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes. If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /calendar/viewcalendar.php. This flaw allows an attacker to inject arbitrary web scripts or HTML via the Subject field.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /forums/editforum.php. It allows an attacker to inject arbitrary web scripts or HTML via the Name field.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /general/search.php?searchtype=simple. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the Search field.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /meetings/listmeetings.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /clients/listclients.php. Attackers can inject arbitrary JavaScript or HTML into the Name field, leading to script execution in the victim's browser.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /projects/listprojects.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.

A cross-site scripting (XSS) vulnerability was discovered in the Chat function of webtareas 2.4p5. This flaw allows attackers to inject arbitrary web scripts or HTML via the Messages field.