CVE Vulnerability Catalog

Zgłoszono potencjalną podatność w niektórych pamięciach USB ThinkPlus, która może umożliwić użytkownikowi z fizycznym dostępem do urządzenia odczyt danych przechowywanych na nośniku.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to execute arbitrary commands with root privileges if the file /opt/images/public_key.der is missing. The vulnerability is triggered by providing a maliciously crafted auth.ini file on the device's SD card.

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

A global buffer overflow vulnerability in TinyOS up to version 2.1.2 exists in the printfUART formatted output implementation used in the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s specifiers using strcat() without checking remaining capacity, causing writes past the end of debugbuf.

A vulnerability in the AIRTH SMART HOME AQI MONITOR Bootloader v1.005 allows a physically proximate attacker to obtain sensitive information via the open UART port of the BK7231N controller (Wi-Fi and BLE module).

A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.

In the Linux kernel, a vulnerability in the seqiv module was found where req->iv is dereferenced after crypto_aead_encrypt returns. Since the underlying request may be freed by an asynchronous completion, this leads to use-after-free.

In the Linux kernel's SUNRPC subsystem, a NULL pointer dereference vulnerability was found in the gss_read_proxy_verf function. A zero-length GSS token results in empty memory pages, and accessing page_address(in_token->pages[0]) causes a NULL dereference even when the copy length is 0.

In the Linux kernel VIA watchdog driver (via_wdt), a vulnerability causes a critical system hang during boot. The issue arises because the allocated MMIO resource lacks a name, resulting in a "<BAD>" entry in the kernel resource tree.

In the Linux kernel's af_alg crypto mechanism, a vulnerability was found due to missing zero-initialization of memory allocated via sock_kmalloc(). Uninitialized context and request structures can lead to use of garbage values; specifically, the newly added 'inflight' field causes random -EBUSY errors in multi-threaded AIO requests.

A vulnerability in the Linux kernel's KVM for x86 causes a hard lockup of the virtual machine after prolonged inactivity with a periodic HV timer. The issue arises from incorrect calculation of the APIC timer expiration in periodic mode, leading to excessive timer interrupts and potential host lockup.

Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allow authenticated attackers with low-level privileges to access other users' information via a crafted API request.

A vulnerability was found in the Linux kernel's ip6gre_header() function in the ip6_gre driver. The bug causes a kernel panic (kernel BUG) due to insufficient skb headroom, which can be exploited by an attacker to crash the system.

A reference count leak was discovered in the Linux kernel when deleting nexthop objects for IPv4 error routes (e.g., blackhole). Error routes were not flushed with the dead nexthop, keeping references on the nexthop object and device, preventing their release.

A bug in the Linux kernel's STMMAC driver causes a crash when executing XDP_TX action in zero copy mode. The issue is due to missing memory type check of the XDP buffer before use, leading to invalid mappings and system panic.

A race condition in the Linux kernel's MPTCP implementation during simultaneous connection setup leads to an inconsistent fallback status, triggering a WARNING and potential system crash.

A bug in the Linux kernel's calipso_skbuff_setattr() function for IPv6 causes a kernel oops via BUG_ON in pskb_expand_head(). The issue stems from an implicit integer cast in __skb_cow() that allows a negative headroom value to be passed to skb_cow() when headroom exceeds INT_MAX.