CVE Vulnerability Catalog

A flaw has been found in Open5GS up to 2.7.1. An unknown functionality in the freeDiameter component causes memory corruption. The attack can be carried out remotely.

A vulnerability was detected in Open5GS up to 2.7.6. The function diam_log_func in lib/diameter/common/init.c of the CER Handler component is affected. Manipulation results in reachable assertion. The attack can be executed remotely. The exploit is public. Upgrading to version 2.7.7 addresses the issue.

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information (Secrets) across different namespaces. By exploiting this, an attacker can modify these Secrets in unauthorized areas, potentially leading to unauthorized access or elevated privileges.

A vulnerability was identified in Open5GS up to 2.7.1. The function pcrf_rx_aar_cb in src/pcrf/pcrf-rx-path.c of the Diameter Rx Handler component is affected. Manipulation of the arguments num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 2.7.2 addresses the issue.

A vulnerability was determined in Open5GS up to 2.7.1. The function mme_s6a_subscription_data_from_avp in src/mme/mme-fd-path.c of the Diameter S6a Interface component is affected. Manipulation of the argument msisdn_len leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.7.2 resolves the issue.

A vulnerability in the Notepad++ installer for Windows 11 x64 and ARM64 prior to 8.9.7 allows PowerShell command execution in the installer's security context via subexpression syntax in the installation path when the context menu component is selected.

A vulnerability in Kestra prior to 2.0.0-rc6 exposes Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels.

A vulnerability in Mira cloud authentication endpoints lacks per-account rate limiting, per-IP throttling, and account lockout after repeated failed login attempts. An attacker can use brute-force methods to gain access to user accounts.

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow.

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue.

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

kkFileView prior to 5.0.1 has an unauthenticated POST /listFiles endpoint that passes the user-controlled path parameter to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root.