CWE-393

Szafir SDK nieprawidłowo zwraca kod sukcesu z procesu weryfikacji podpisu cyfrowego nawet wtedy, gdy zaufanie do certyfikatu podpisującego nie mogło zostać ustalone. Powoduje to, że aplikacje korzystające z SDK traktują podpis jako ważny, mimo że łańcuch certyfikatów pozostaje niezweryfikowany, co umożliwia authentication bypass i podszywanie się pod użytkowników.

Windows Hyper-V Remote Code Execution Vulnerability

Podatność typu out-of-bounds write w funkcji tsip_StoreMessage() biblioteki WolfSSL dotyczy wyłącznie konfiguracji korzystających z portu Renesas TSIP dla TLS 1.3. Błąd umożliwia zdalne uszkodzenie stanu sterty (heap) i może prowadzić do zdalnego denial of service (crash) urządzenia.

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

W OpenSC pam_pkcs11 przed wersją 0.6.13 funkcja pam_sm_authenticate() błędnie zwraca PAM_IGNORE w wielu sytuacjach błędu (takich jak błąd wywołany kartą inteligentną przed zalogowaniem), umożliwiając obejście mechanizmu uwierzytelniania.

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.