CVE Vulnerability Catalog

A vulnerability in the rtapi_app component of the linuxcnc-uspace package in LinuxCNC before version 2.9.9 allows privilege escalation. The program is installed SUID root and loads shared library modules via dlopen() using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library, and because the process retains elevated privileges during module loading, this results in local privilege escalation to root.

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` only checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after validation, allowing an attacker to bypass the protection.

The HTTP server in Zephyr (subsys/net/lib/http) is vulnerable to path traversal in the static filesystem resource handler (HTTP_RESOURCE_TYPE_STATIC_FS). An attacker can send a GET request with ../ sequences in the URL path to read arbitrary files outside the configured root directory. Affects versions v4.0.0 through v4.4.0 when file system support (CONFIG_FILE_SYSTEM) is enabled.

A logic operator precedence flaw in the IPv6 Neighbor Discovery handlers of Zephyr RTOS causes critical RFC 4861 validity checks to be bypassed. The incorrect boolean expression combines the Hop Limit == 255 test, source/target address checks, and length validation with the ICMPv6 code check in a way that for legitimate packets (code == 0) the entire predicate evaluates false, so the packet is never dropped and all other checks are silently skipped. This includes the mandatory Hop Limit verification (proving on-link origin) and, for Router Advertisements, the link-local source requirement.

A heap buffer overflow vulnerability has been discovered in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 versions 2.3.3 through 2.3.6. An attacker can exploit this to cause a Denial of Service (DoS) by sending a crafted payload.

A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.

In Zephyr OS, the mcumgr_serial_process_frag() function calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and writing through the NULL pointer causes a system crash.

The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.

In Coolify prior to version 4.0.0-beta.471, server and project lookups are not scoped to the current team. An authenticated user can access servers and projects belonging to other teams by specifying their IDs directly.

The USB CDC-NCM driver in Zephyr RTOS ignores the return value of usbd_ep_enqueue(). When enqueue fails (e.g., during USB bus suspend), the function blocks on a semaphore that never signals, causing a permanent deadlock of the TX thread and halting network transmission until reboot.

A missing critical step in authentication was found in Apache Tomcat's JNDIRealm when configured to use GSSAPI. Attackers can authenticate without providing the correct password.

An improper authorization vulnerability in Apache Tomcat causes security constraints for the default servlet to ignore any configured HTTP method or method omission. This affects Tomcat versions from 7.0.0 through 11.0.22.

A vulnerability in Apache Tomcat allows a replay attack against the EncryptionInterceptor in the cluster component. The issue stems from improper authentication, enabling an attacker to reuse intercepted data.

An Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat causes special roles and empty authorization constraints to be omitted when the effective web.xml is logged. Affected versions include 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100.

A vulnerability was found in Apache Tomcat where a detection of error condition without action occurs when configuring CRLs for a FFM based connector. Affected versions are from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, and from 9.0.83 through 9.0.118.

An Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve causes subsequent non-OR conditions to be skipped if the first condition in an OR chain matches.

A basic XSS (Cross-Site Scripting) vulnerability was found in the number guess example application in Apache Tomcat. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code.

In Coolify prior to 4.0.0-beta.474, the HMAC key for GitHub webhooks can be null, causing an empty string to be used as the key. An attacker can compute a valid signature and trigger unauthorized deployments.

In Coolify prior to 4.0.0-beta.470, a critical authenticated remote code execution (RCE) vulnerability was found. The flaw is in the handling of the install_command parameter, which is directly concatenated into a shell command during Nixpacks build, allowing arbitrary command execution on the host.