CVE Vulnerability Catalog

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature. The vulnerability requires local access to the system.

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. The vulnerability concerns the origin verification process in the MSAL library.

The DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 improperly verifies the source of DNS replies. A remote attacker can insert a chosen address into the device's DNS cache via a forged DNS reply.

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.

In MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, checking the wrong grantor privileges. A low-privileged attacker who can name another account can set that account's password.

In MariaDB server, the #mysql50# bypass prefix allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name, causing crashes, data corruption, data exfiltration, or remote code execution. This affects versions from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

In MariaDB, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump do not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can create an object with crafted identifiers or values and then execute injected SQL when the poisoned output is applied.

In Mailu, domain managers can enable spoofing for hosted domains they do not control. A malicious domain administrator can enable spoofing for another hosted domain and send emails authenticated with DKIM/SPF for domains they should not be able to.

In Mailu, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions.

In MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() do not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can call such a UDF with a filesystem path to read or write files the database account is not authorized to access.

In MariaDB server, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This affects versions from 12.3.1 until 12.3.3 and 13.0.2.

In MariaDB server, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This affects versions from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

In MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the parser advances past a nested geometry header without verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR.

In destructive_command_guard (dcg), nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. A hung PreToolUse hook fails open, allowing the destructive command to proceed.

In PeerBanHelper from 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so they are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database.

In Tandoor Recipes prior to 2.6.10, the application looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. The endpoint returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import.

In Tandoor Recipes prior to 2.6.10, unvalidated sort_order and order_field strings are passed into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields.