CVE Vulnerability Catalog

Arm Keil MDK-Middleware version 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX buffer. The issue affects the library's FTP server component.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow a pre-authentication out-of-bounds read in SNMP processing. The issue affects the library's SNMP component.

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers to place a symbolic link inside a user's home folder to access files outside the virtual filesystem root, because confinement is enforced only against the requested path and not the on-disk destination of the link.

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides using case-insensitive path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name.

An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the installer's executable-resolution logic. This requires local access to the system.

OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can exploit this to cause a denial of service.

In the Linux kernel, an AMD CPU erratum (#1718) was addressed where the processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. The kernel detects the erratum and applies a software workaround when no microcode fix is present.

In the Linux kernel, dm-integrity in inline mode has a stack buffer overflow when the tag size exceeds HASH_MAX_DIGESTSIZE; integrity_sector_checksum pads the result with zeroes past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics on the first read. This is not considered a security bug because it can only be triggered by root.

In the Linux kernel, tee_dyn_shm_alloc_helper() does not check for a zero size, leading to alloc_pages_exact(0) and undefined get_order(0) behavior. This trips the page allocator warning and fails the allocation, and on a panic_on_warn kernel it ends the boot. It can be triggered via TEE_IOC_SHM_ALLOC with size 0.

In the Linux kernel, an io_uring ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until enabled, allowing bypass of allowed register opcodes. This also applies to restrictions inherited from the task, so a task with restricted opcodes can create a disabled ring, issue any register opcode, and then enable it. The fix marks rings with inherited restrictions and keeps checking register opcodes while the ring is disabled.

In the Linux kernel, drm/vc4 does not stop the hangcheck timer or job_done_work at V3D unbind, leading to V3D register access through a NULL vc4->v3d pointer and callbacks after memory is freed. The fix drains the timer and cancels reset_work in vc4_v3d_unbind() and flushes job_done_work.

In the Linux kernel, btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so the fix rejects it in the bounds check.

A Linux kernel bug causes a kernel panic during boot when a boot-time function tracer with a filter is used (e.g., ftrace=function ftrace_filter=pud_free_pmd_page). During early tracer initialization, a trampoline is made read-only, splitting a large page that CPA immediately collapses, freeing the split page table via pagetable_free_kernel(). That function queues work on system_percpu_wq, which is still NULL at that point, resulting in a general protection fault and kernel panic.

In the Linux kernel on RISC-V, patch_map() incorrectly assumes vmalloc addresses are directly writable when CONFIG_STRICT_MODULE_RWX is disabled. Since BPF marks its text read-only via set_memory_rox() regardless, the write triggers a page fault and returns -EFAULT, preventing JIT compilation of BPF programs and triggering WARN_ON().

In the Linux kernel Bluetooth MGMT subsystem, pending commands flushed on power off receive an incorrect status. cmd_complete_rsp() passes a struct pointer instead of the status, so the byte sent comes from the socket representation (or 0x00) rather than the intended MGMT_STATUS_NOT_POWERED or MGMT_STATUS_INVALID_INDEX.

In the Linux kernel, the drm/amdgpu vblank counter callback reads display registers without holding reset_domain->sem. During GPU recovery, this can cause hardware access while reset is in progress, triggering a lockdep warning and setting TAINT_WARN. The fix acquires the reset semaphore for reading and falls back to the cached software vblank count when reset is in progress.

In the Linux kernel, the ASoC samsung i2s probe function sets the device to runtime PM active with only the iis bus clock enabled, but does not enable op_clk, which is later disabled in the suspend callback. This causes an unbalanced clock disable and an 'i2s_bus already disabled' warning during boot on Exynos5250 Arndale. The fix enables op_clk in probe and disables it in remove.

In the Linux kernel openvswitch module, set_ipv6_addr() calls update_ipv6_checksum() when rewriting IPv6 addresses on fragments, which reads an uninitialized transport header. This triggers a warning under CONFIG_DEBUG_NET but is otherwise harmless. The fix returns early when the protocol is NEXTHDR_FRAGMENT.

The vulnerability in Apache Camel's OAuth component stems from a static token cache shared by every resolver instance in the JVM, keyed only on the token endpoint and client ID. Profiles that share an endpoint and client ID but differ in scope or client secret therefore receive each other's tokens, potentially granting broader authority or reaching a service the token was not issued for.