CVE Vulnerability Catalog

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read. This reliably terminates the subscriber process and causes a denial-of-service.

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leading to a denial-of-service condition.

The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer.

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.

In the ansible-collection-redhat-leapp, when a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL backup archive is created with insecure permissions. A local non-root user on the managed node can read sensitive archived data.

In the ansible-collection-redhat-leapp, an attacker with write access to a managed node can manipulate the Leapp report content. When an operator runs a specific remediation task, the manipulated report causes the Ansible controller to read its own local files and copy them to the managed node, leading to disclosure of sensitive data like private keys or credentials.

RapidRAW before version 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerability is reachable via two vectors: automatic preset fetching from a remote repository and manual preset file import.

Kamaji, the Hosted Control Plane Manager for Kubernetes, prior to version 26.7.4-edge contains an SQL injection vulnerability in the PostgreSQL and MySQL datastore drivers. These drivers build DDL statements by interpolating user-supplied DataStoreUsername/DataStoreSchema fields without proper escaping, allowing SQL injection over Kamaji's root connection to the shared datastore. The etcd driver is not affected.

Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware from Watchfire's Remote Support filestore.

Sylius Mollie Plugin prior to versions 2.2.8, 3.2.4, and 3.3.1 exposes GET /{_locale}/thank-you and GET /{_locale}/get-code endpoints that look up sequential orderId values without ownership or session checks. This exposes order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email.

The re2 library for Node.js prior to version 1.25.2 contains a vulnerability in the String.prototype.match implementation with a global RE2 pattern that can match the empty string. The function fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory.

AdonisJS HTTP Server versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2 interpolate error.message into the default HTML exception response without escaping. This allows execution of attacker-controlled JavaScript when a victim opens a crafted missing-route URL and no custom status page or JSON response handles the error.

GoAccess prior to version 1.11 contains a vulnerability in the parse_ios() function, which uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows reading up to approximately 4 KB beyond the heap allocation and conditionally crashing GoAccess using a crafted User-Agent in a processed access log.

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. An attacker can inject a malicious script that executes in the victim's browser.