CVE Vulnerability Catalog

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. This is due to improper configuration of the support tunnel feature. An attacker could enable the support tunnel, set a key, and derive the tunnel password, allowing them to run any system command with root access.

A vulnerability in how Cisco FTD Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections, leading to a DoS condition. The issue is that the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this by sending a large and sustained number of crafted remote management connections.

A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured management interface access list. The issue is due to inconsistent configuration of access lists. An attacker could send crafted remote management traffic to the local IP address, bypassing the policies.

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. The backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.

W Arm Mbed TLS przed wersją 2.16.6 oraz 2.7.x przed wersją 2.7.15 odkryto problem, który pozwala atakującemu na odzyskanie długoterminowego klucza prywatnego ECDSA. Atak opiera się na pomiarach bocznych, które umożliwiają rekonstrukcję współrzędnych projektowych oraz wykorzystanie ataków do uzyskania klucza prywatnego.

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference.

The eivindfjeldstad-dot library below 1.0.3 is vulnerable to Prototype Pollution. The 'set' function can be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL.

In MISP before version 2.4.124, the file app/Model/feed.php allows administrators to choose arbitrary files for ingestion. This does not leak the full contents of a file but can leak strings that match certain patterns, such as passwords from database.php or GPG key passphrases from config.php.

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

MISP version 2.4.122 has a Persistent XSS vulnerability in the sighting popover tool. This is related to the file app/View/Elements/Events/View/sighting_field.ctp.

MISP version 2.4.122 has a reflected XSS vulnerability via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.

CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the 'static' part of the validation context to be not applied, even though it was visible in the active config dump.

The GNU C Library (glibc) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, as seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.