CVE Vulnerability Catalog

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

A flaw was fixed in the Linux kernel BPF verifier's 32-bit zero extension logic. The removal of register liveness tracking in commit 107e16979905 allowed certain verification paths to miss the zext_dst mark, potentially letting a BPF program inject an arbitrary value into the upper half of a register. The fix replaces subreg_def-based logic with static liveness analysis in bpf_compute_live_registers().

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator.

A vulnerability in the Linux kernel Bluetooth ISO module has been resolved. The content of a Periodic Advertisement Report is copied to BASE only if the service UUID matches the Basic Audio Announcement Service UUID.

A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 have a missing authorization vulnerability (CWE-862) in the cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them without privilege checks, allowing catalog changes to be blocked cluster-wide or sessions with temporary tables to be repeatedly disconnected.

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. As a result, previously issued tokens remain active even after the user's access context has been modified or revoked.

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by also sending crafted queries to a zone the attacker controls, may potentially achieve remote code execution.

Apache bRPC versions before 1.18.0 expose builtin /flags and /pprof services that allow a remote attacker to change dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) and create directories or overwrite files with the server process privileges. Additionally, the ?seconds= parameter in /pprof is not clamped, enabling an attacker to hold the process-wide CPU profiler for an arbitrarily long time.

HTTP request/response smuggling vulnerability in Apache bRPC versions < 1.18.0 stems from inconsistent HTTP/1.1 header parsing in its bundled parser. bRPC accepts malformed header forms (space before colon, spaces in Content-Length values, obs-fold, chunked trailers merged as headers, Transfer-Encoding lists with whitespace), allowing attackers to smuggle requests or headers when bRPC is deployed behind a proxy or load balancer.

Improper authorization in Apache bRPC (versions < 1.18.0) allows remote attackers to access builtin services through the public port. Protobuf-based protocol dispatch paths computed but did not enforce the security_mode flag, allowing invocation of services such as brpc.vars or hotspots.

A vulnerability in Apache bRPC (versions < 1.18.0) stems from an interpretation conflict in HTTP path handling between bRPC and a front proxy. The FindMethodPropertyByURI() function skips empty path segments (consecutive slashes), so paths like //flags are dispatched as /flags, even though RFC 3986 treats them as distinct. Additionally, HTTP/2 does not validate the :path pseudo-header, allowing bypass of proxy ACL rules and access to internal services.

A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. After the RDMA handshake completes, the server keeps parsing the TCP fd as an RPC channel, sharing the input buffer and parser state with RDMA CQ event processing without synchronization, leading to corruption and a crash.

A vulnerability in Apache bRPC versions before 1.18.0 allows a malicious remote peer to crash the process by racing connection teardown against health check revival. In the window where the Socket is addressable but has no file descriptor, a CHECK failure terminates the process, resulting in denial of service.

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply with a malformed exception struct, the client decodes it without catching Apache Thrift exceptions (TProtocolException, TTransportException or std::length_error), causing std::terminate() and terminating the whole process along with every other in-flight RPC.

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. The parser recursively parses nested objects and arrays without any depth limit, leading to stack overflow and process crash.