Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls  strlen()  on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

Unisoc IMS Out‑of‑Bounds Read Leading to Remote Denial of Service

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling

Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.

StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

Out-of-bounds read in Zephyr HTTP client debug logging of response header fields

The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte. The slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET. The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region. The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it).

Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing

Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.

Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.

ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Tenda AC19 saveParentControlInfo heap-based overflow

A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

liboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss_verify_inc.c:215)

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0.

chromium-browser: Out of bounds read in Animation

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.