Code Injection via Unescaped Message Definition Files in ROS#

A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program.

Unchecked Configuration File Execution Leading to Remote Code Execution on Siemens meta-iot2050

A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.

Loopback Listener Misconfiguration Exposing MCP Server to Remote Access

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.

SSRF Vulnerability in NVIDIA NeMo Deploy Enables Information Disclosure

NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure.

Missing permission check in ticket layout API

Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.

Unbounded Deployment Package Download Enables Denial of Service in Eclipse Kura

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services. The same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit. Workarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access).

OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.

Windows Task Scheduler Elevation of Privilege Vulnerability

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Privilege Escalation via Wire Graph Update in Eclipse Kura

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3.

Cleartext Storage Exposes Other User’s Session Tokens to Local Authenticated Attackers

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.

Out-of-Bounds Write in dr_libs WAV File Parser

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Unauthenticated Remote Modification of Trusted EPM Core Certificates in Ivanti Cloud Services Application

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.

Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Windows GDI Information Disclosure Vulnerability

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

Linux Foundation Magma interceptors.go hard-coded credentials

A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Remote Code Execution via Unauthenticated SQL Injection in Ivanti Endpoint Manager Core

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

Out-of-Bounds Read in dr_libs dr_mp3 Initialization

A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

Cleartext Transmission Exposing Sensitive Data Enables MITM Modification in Ivanti Endpoint Manager Agent

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.