CVE Vulnerability Catalog

The ThreadX module manager's dispatch layer, when reaching a kernel object's delete service, only checked whether the pointer lay outside the module's own code and data — the policy for using an object, not destroying it. A module could name any object it had a pointer to (including objects created by the application or other modules) and have the privileged dispatcher delete it.

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.

The X.509 parser in NetX Secure accepts an RSA public key of any size, but signature-verification paths decrypt into fixed-size buffers dimensioned for the NX_CRYPTO_MAX_RSA_MODULUS_SIZE default of 4096 bits. A certificate with a larger modulus causes an out-of-bounds write past a file-scope static during ordinary certificate-chain verification, reachable pre-authentication.

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is reported to the server as though it were a header, letting a client control request framing decisions it should not reach.

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

_gx_multi_line_text_view_display_info_get() reads one byte past the end of the application's text buffer when the given string ends with a carriage return (\r). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in _gx_multi_line_text_view_string_total_rows_compute() and a row of text not present in the source.

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Apache CouchDB 3.5.2 and below contains an unlimited gzip decompression routine in chttpd. Any remote client can cause a denial of service via memory exhaustion.

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

SuggestArr before 3.0.0 contains an authentication bypass in its local_bypass mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to gain an unauthenticated admin session.

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability allowing remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it.

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass in BasicAuthHandler. An attacker can log in as an LDAP/AD-delegated user by sending a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind accepted as successful authentication.

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. A crafted Cineon file with a huge declared width wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with the font.

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import. An attacker can supply a crafted font whose wasm module places the output buffer near the end of linear memory, writing glyph-name bytes into host memory and crashing or corrupting applications.

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them.

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.