CVE Vulnerability Catalog

P-Net before 1.0.3 does not release the RPC session allocated for a request naming an unknown interface or object UUID and does not start a timeout for it. Repeated requests with different UUIDs exhaust available sessions, after which the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until restarted.

ASP.NET Core has incorrect default permissions that allow an authorized attacker to elevate privileges locally. The issue concerns the default permission configuration in the ASP.NET Core environment.

Adobe Digital Editions is affected by a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction in that a victim must open a malicious file, and the scope is changed.

OpenText Advanced Authentication Server contains an acceptance of extraneous untrusted data with trusted data vulnerability that allows accessing functionality not properly constrained by ACLs. This affects versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0.

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix is to create a secure configuration; the 6.6.2.0 release has a best practice entry if the configuration is insecure.

P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected due to incorrect endianness of its data representation. The session and its AR remain allocated, so repeated requests exhaust available sessions, after which the device stops answering new RPC requests, including Connect, until restarted.

P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user-specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device.

P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the APDU status offset was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer.

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, VLAN tags and PROFINET FrameID. The VLAN tag loop has no upper bound, so a truncated frame or a frame consisting only of VLAN tags causes a read past the end of the receive buffer.

P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device.

P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from an ARVendorBlock request field that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer without comparing it to the buffer size or block length. A crafted Connect request causes an out-of-bounds write, potentially leading to a crash (denial of service) or arbitrary code execution. This option is disabled by default.

P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advances to the next port, so the request never completes and the device stops responding.

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) is used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. The flaw involves improper protection of such data.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs.

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.

IBM Langflow OSS versions 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. The flaw involves weak protection of authentication data.