CVE Vulnerability Catalog

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists. MICE is disabled by default and must be explicitly enabled; Miracast P2P is not affected.

The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 splits the raw signature in half by its actual byte length instead of enforcing the fixed length required by RFC 7518 §3.4, then decodes each half ignoring leading zero bytes. An attacker holding one valid token can prepend leading zero bytes to each of the R and S halves to produce many distinct signature byte strings that verify against the same key (signature malleability).

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API, an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters is routed into convert_sfm_to_crt/1, which tries to recover the missing primes by factoring the modulus. When the modulus cannot be split into two factors, the search loop performs a modular exponentiation over the attacker-sized modulus on every iteration and never succeeds.

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder whose execution time depends on the secret scalar, making public entry points (e.g., scalarmult/2, x25519/2) timing-dependent on the private key. This issue affects jose from 1.10.0 before 1.11.13.

The jose library exports password-encrypted private keys in PKCS#8 format using hardcoded PBES2 parameters: PBKDF2-HMAC-SHA256 with 2048 iterations and an 8-byte salt, neither of which can be overridden. These values are far below current guidance, enabling a cheap offline password-cracking attack to recover the private key. The issue affects versions from 1.10.0 before 1.11.13.

jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shared_secret(from(YourJWK), from(MyJWK)). Because from/1 returns an already-parsed jose_jwk record unchanged, passing two JWKs whose key types differ makes the fallback clause re-enter with identical arguments, producing an unbounded tail-recursive loop that never returns and never crashes.

Improper Handling of Highly Compressed Data (Data Amplification) in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function decompresses the DEFLATE-compressed plaintext of a JWE carrying the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on output size or inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2), so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value.

The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked, reducing forgery resistance from 2^-128 to 2^-8.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The Asterisk HTTP server, AMI, and AMI access via HTTP must all be enabled (disabled by default), and the attacker must convince the user to click a malicious link.

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with 200 OK. The crash has so far only been reproduced when Asterisk is built with Address Sanitizer, which is not used in production systems.

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chan_ooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable.

A vulnerability was found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 in an unknown function of patientregistration.php. Manipulating the pat_name argument leads to cross-site scripting. The attack can be launched remotely, the exploit has been disclosed publicly and may be used; the project has not responded.

A flaw was found in a2a-java up to 1.2.0.Final affecting the getMessage function of the JSON-RPC Error Handler component. The manipulation causes information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.3.0.Final fixes the issue.

A vulnerability was detected in a2a-go up to 2.4.0 affecting the CreateExecutor function in a2asrv/agentexec.go of the Push Notification Handler component. The manipulation results in information exposure through error messages. The attack can be launched remotely, and upgrading to version 2.5.0 mitigates the issue.

A security vulnerability was detected in a2a-dotnet up to 1.0.0-preview2 affecting the A2AJsonRpcProcessor.ProcessRequestAsync function in src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the Parser component. The manipulation leads to information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.0.0-preview3 resolves the issue.

In Tornado before 6.6.0, HTTP/1.1 chunked transfer encoding decoding processes already-arrived body data without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process. SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server.