CVE Vulnerability Catalog

A security flaw was discovered in philz1337x clarity-upscaler in the create_html_for_item function of modules/ui_extra_networks.py (Extra Networks Card Rendering component). Manipulation of the Description argument results in cross-site scripting (XSS), and the attack can be executed remotely.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. This vulnerability may lead to data disclosure or disruption of file services.

A vulnerability in the Zephyr Bluetooth host stack causes a double-free of a net_buf in the ATT transmit path when signing fails. Additionally, on a bt_l2cap_send_pdu() failure, a buffer may be reused with a stale signature, leading to an out-of-bounds write. This results in memory corruption, crashes, or potential code execution.

A vulnerability in the Bluetooth Mesh stack in Zephyr causes a permanent loss of message contexts from the pool, leading to denial of service (DoS) after pool exhaustion. An attacker in the mesh network can intentionally trigger context leaks, and the device stops responding to requests until reboot.

In the Bluetooth Mesh Access-layer delayable message queue (subsys/bluetooth/mesh/delayable_msg.c), three lists and one delayed work item are shared between two cooperative threads without synchronization. A missing NULL check after sys_slist_get() and a race between bt_mesh_delayable_msg_manage() and delayable_msg_handler() allow a read-modify-write through a NULL-based pointer, faulting the system workqueue thread or resetting the node. The flaw does not lead to memory corruption or code execution — the impact is loss of availability of the affected node.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

A vulnerability in Linketic CityGaussian up to 2.0 affects the function parse_cfg_args in internal/utils/common.py of the Sidecar Parsing component. Manipulation of the argument cfg_args leads to code injection. The attack can only be performed locally. The project was informed but has not responded.

A vulnerability in EricLBuehler Mistral.rs up to 0.9.3 affects the function calibration_apply in mistralrs-server-core/src/handlers.rs. Manipulation of the argument save_cimatrix results in path traversal. The attack can be initiated remotely. The exploit is public. Upgrading to 0.9.4 fixes the issue.

A vulnerability in EricLBuehler mistral.rs up to 0.9.3 affects the function is_global_ip in mistralrs-server-core/src/media_source.rs. Manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit is public. Upgrading to 0.9.4 is recommended.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

A vulnerability in IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

IBM Planning Analytics 2.0 and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header, granting full platform-scope tenant API access.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.