CVE Vulnerability Catalog

In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.

In the systeminformation library for Node.js before 5.33.14, the Linux `networkStats(iface)` implementation uses the caller-supplied interface value in an `fs.existsSync()` check and to build `/sys/class/net/<iface>` paths without verifying it is a single interface-name segment or that the resolved path stays under `/sys/class/net`. An attacker controlling `iface` can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. This requires local filesystem setup; the issue is fixed in 5.33.14.

Authlib (Python OAuth/OIDC library) versions 0.15 through 1.9.1 contain a flaw in the documented ClientConfigurationEndpoint.authenticate_client and check_permission implementations that fail to verify the credential belongs to the target client. This can allow reading, modifying, or deleting another client's registration. The issue is fixed in 1.9.1.

In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.

In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.

In EPICS Base 7.0.10 and earlier, improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution.

Autodesk Fusion contains an Exposed Dangerous Function vulnerability via the TextCommands.LoadDll API command. A maliciously crafted dynamic library loaded from an arbitrary path can execute arbitrary code in the context of the current process.

GFI KerioConnect before 10.0.8 Patch 2 contains a stored XSS vulnerability in the Webmail component. An attacker can upload a crafted SVG email attachment that bypasses event-handler attribute sanitization and executes JavaScript in the victim's authenticated Webmail session. The exploit is actively used to steal credentials and mailbox contents.

In libXi before 1.8.4, a malicious X server can cause a heap overflow by injecting a large DEVICE_ENABLE reply. This may lead to a crash or potential code execution.

A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

A malicious X server could send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter an endless loop.

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. An attacker could gain access to functions or resources they should not be authorized to use without logging in.

An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Private keys for eight eMudhra intermediate CA certificates have been compromised, which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man-in-the-middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

Private keys for eight eMudhra intermediate CA certificates have been compromised, which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man-in-the-middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

An unauthenticated attacker can bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.