CVE Vulnerability Catalog

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.

Lemur before version 1.9.3 contains a vulnerability in API endpoints that allows an unprivileged user to create a duplicate certificate without required permissions and then revoke it, potentially leading to denial of service for all certificates. The fix in version 1.9.3 rejects duplicates and requires authority access.

Lemur up to version 1.9.3 did not enforce CertificatePermission checks when assigning identifiers to the replaces field in certificate create, upload, and edit requests. This allowed an attacker with non-read-only access to disable victim certificate notifications and mark them as replaced, potentially leading to deployment of attacker certificates on victim endpoints. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 exposed GET /api/1/destinations and GET /api/1/destinations/ with only authentication, without requiring admin permission, and responses included raw options with plaintext passwords and private keys. This allowed a read-only user to retrieve credentials for remote certificate-deployment hosts. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 did not enforce the ACME directory host allowlist when updating acme_url via PUT /api/1/authorities/, allowing an authority-role user to set the URL to an internal service or cloud metadata address (e.g., 169.254.169.254). During the next issuance operation, Lemur made an outbound request to that address, potentially exposing internal services or cloud metadata. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 allowed an authority-role user to update acme_url without revalidation and direct the ACME client to an attacker-controlled server. That server could return URLs (newNonce, newOrder, authorizations, finalize) pointing to internal services or cloud metadata, and Lemur followed them without host validation. The issue is fixed in version 1.9.3.

FUXA version 1.3.2 and earlier improperly handled session refresh, allowing an attacker with a previously issued privileged refresh cookie or access token to continue minting privileged JWTs even after account deletion, disablement, role removal, or demotion. This enabled continued unauthorized access to user management, project manipulation, runtime configuration, and backdoor-account creation. The issue is fixed in version 1.3.3.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

ZEBRA (Zcash node) before version 4.5.0 has a vulnerability allowing an unauthenticated IPv4 peer to deterministically terminate a synced node. By completing a P2P handshake and advertising an invalid mempool transaction, the attacker can trigger an assertion in the code, causing a panic/abort that stops the node. The issue is fixed in version 4.5.0.

ZEBRA before version 4.5.0 has a vulnerability allowing a remote unauthenticated P2P peer to stall a node by racing an invalid block body against the valid canonical body for the same block header hash. This causes the node to reject the valid body and remain stuck one height behind until restart or reorganization. The issue is fixed in version 4.5.0.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function.

FUXA before version 1.3.2 has a vulnerability allowing a remote unauthenticated attacker to perform SSRF (Server-Side Request Forgery) via the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers. By manipulating property.address or endpoint connection data, the attacker can make the server call axios.get against arbitrary HTTP/HTTPS destinations, including internal services, cloud metadata, OPC UA, or ODBC services. The issue is fixed in version 1.3.2.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause unlimited resource allocation. Successful exploitation may lead to denial of service.

NVIDIA NVOS for network switches contains a vulnerability in the SSH server configuration when PKA-only mode is enabled. An administrator may inadvertently enable an alternative authentication path, which, if default passwords are not changed, could lead to unauthorized access and privilege escalation.

NVIDIA Cumulus Linux contains a vulnerability in the LLDP daemon, where an unauthenticated attacker on an adjacent network could cause a buffer overflow by sending crafted LLDP frames. Successful exploitation may lead to code execution.

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could exploit improper privilege management. Successful exploitation may lead to privilege escalation.

The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System before version 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs.

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.