CVE Vulnerability Catalog

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Authorization Bypass Through User-Controlled Key vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges.

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space left by the IV. With a 13- to 15-byte IV the counter is only 1 to 3 bytes, so for longer input the counter wrapped and the keystream repeated from the start of the same packet. The call still returned the full input length as though every byte had been correctly transformed, with no exception and no short length.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit it to cause denial of service, information disclosure, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges, filesystem access, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could exploit it to achieve elevation of privileges, protection mechanism bypass, and unauthorized access.

The elixir-protobuf library in versions from 0.8.0 before 0.17.1 contains an uncontrolled recursion vulnerability in Protobuf.JSON.Decode. An unauthenticated remote attacker can crash the decoding process via a deeply nested JSON document when the schema contains a self-referential or cyclic message type.

In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.

In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.

In the Linux kernel, during veth channel resize, XDP program pointers are not cleared for removed RX queues. This can lead to running a freed program after a later channel increase, causing a system crash.

In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).

In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.

A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.

In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.

A vulnerability in the LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) allows an attacker in radio range to write data beyond the bounds of the static mod_src_param structure in .bss. Missing size checks when copying subgroup metadata from a BASE frame leads to a buffer overflow, potentially enabling remote code execution in the Bluetooth RX thread.

A vulnerability in the Zephyr RTOS kernel allows an unprivileged user-mode thread to perform an out-of-bounds write in kernel memory. It stems from missing overflow checks when calculating allocation sizes for dynamic kernel objects, leading to undersized heap allocations. An attacker can exploit this to escalate privileges and execute arbitrary code at the kernel level.

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin.

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys.

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection. This issue affects WP Rocket: from n/a before 3.23.5.

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user named in a request. Any authenticated user can make the plugin act as an arbitrary other user, including an administrator, exposing that user's account details and leading to account takeover.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display.