CVE Vulnerability Catalog

The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.

CKAN MCP Server before 0.4.112 contains a vulnerability in canonicalizeParams in src/utils/cache.ts that serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide. An attacker can prime a shared cache with a response for a victim's distinct query.

CKAN MCP Server before 0.4.112 contains a vulnerability in the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts. The isValidMqaServer function validates the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response.

crun before version 1.28 contains a vulnerability in the default device setup that opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates default device nodes and stdio symlinks at the symlink target outside the container rootfs. This can lead to overwriting existing files, such as ptmx.

compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. The issue affects the save_doctor function in /save_file.php, allowing unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. The issue affects unknown code in /admin/reporting/sales/ of the Backend Reporting Endpoint, leading to authorization bypass. Remote exploitation is possible, and the exploit is publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this, leading to information disclosure.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to privilege escalation.

A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can delete arbitrary files with the privileges of the RevPiPyLoad daemon, leading to loss of configuration integrity and denial of service.

A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can read arbitrary files with the privileges of the RevPiPyLoad daemon, including sensitive configuration and credential material.

A CWE-352 Cross-Site Request Forgery (CSRF) vulnerability was identified in the web-based configuration backend of KUNBUS PiCtory version 2.16.0. A remote unauthenticated attacker can perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. The issue affects unknown functionality in /admin/customers/view of the Backend Customer Detail Feature. Manipulation of the ID argument results in authorization bypass. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A vulnerability was determined in Webkul Bagisto up to 2.4.4. The issue affects an unknown function in /admin/customers/login-as-customer/ of the Admin Customer Impersonation Feature. Manipulation of the ID argument causes authorization bypass. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A race condition vulnerability in the event notification functionality of KUNBUS piControl version 2.6.2. A local authenticated attacker can corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory by issuing concurrent crafted requests from multiple threads through the piControl character device.

A flow in the dnssec.c library causes an infinite loop in the dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.

A flaw in Samba's CTDB, the clustered database service, involves insufficient integrity validation of received CTDB protocol packets. A remote attacker with access to the CTDB private network can trigger denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

A path-traversal vulnerability in the logback-classic module (Java) by QOS.CH Sarl. An MDC-based discriminator value flows unsanitized into a nested FileAppender path, allowing an attacker who influences that MDC value (e.g., via an HTTP header) to create and append log files outside the intended directory. Affects versions from 0.9.14 through 1.6.2.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.