CVE Brief Security Intelligence

A heap buffer overflow in PostgreSQL regular expression processing allows an authenticated database user to execute arbitrary code with the privileges of the database operating system user.

A heap buffer overflow in the PostgreSQL to_char(timestamptz) function allows an authenticated user to execute arbitrary code via a malicious POSIX timezone abbreviation.

A heap-based buffer overflow in the PostgreSQL plperl module allows authenticated function owners to execute arbitrary code with the privileges of the database operating system user.

A heap-based buffer overflow in the PostgreSQL pg_stat_statements module allows authenticated users to execute arbitrary code by crafting queries containing array constants.

An integer wraparound vulnerability in PostgreSQL tsvector and tsquery functions allows authenticated users to trigger out-of-bounds writes via crafted large inputs.

A type confusion vulnerability in the PostgreSQL refint module allows authenticated object creators to execute arbitrary code as the operating system user running the database.

A type confusion vulnerability in PostgreSQL internal data type arguments allows authenticated users to execute arbitrary code with the privileges of the database service account.

An integer wraparound vulnerability in the PostgreSQL fuzzystrmatch module allows authenticated users to execute arbitrary code via specially crafted inputs to specific string functions.

A type confusion vulnerability in the pg_restore_attribute_stats function allows an authenticated object creator to execute arbitrary code on the PostgreSQL server.

A type confusion vulnerability in the PostgreSQL portal and cursor lifecycle allows authenticated users to execute arbitrary code as the system user running the database.

An authorization bypass in the Microsoft Container Migration Solution Accelerator allows authenticated users to manipulate keys, potentially leading to unauthorized system access or data modification.

An unauthenticated PHP object injection vulnerability in the Booking Activities plugin for WordPress allows attackers to execute arbitrary code.

The shescape JavaScript library is vulnerable to uncontrolled resource consumption, which can lead to a denial of service.

CamaleonCMS contains a stored cross-site scripting vulnerability in the post title parameter, allowing authenticated users to execute arbitrary JavaScript in an administrator's browser.

A SQL query validation bypass in the OpenSearch SQL plugin allows authenticated actors to execute arbitrary code on Apache Spark workers via the direct query endpoint.

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducin.

A SQL injection vulnerability in the PostgreSQL EXTRACT function allows an object owner to execute arbitrary SQL commands as a superuser.

A heap-based buffer overflow in the PostgreSQL pg_dump utility allows an authenticated user to achieve arbitrary code execution as the OS user running the utility via a crafted transform list.

OpenChoreo contains an authorization bypass vulnerability that allows authenticated users to access resources outside their intended scope.

OpenChoreo contains an OS command injection vulnerability allowing authenticated users to execute arbitrary commands on the underlying Kubernetes host.

Elasticsearch contains an out-of-range pointer offset vulnerability in its native machine learning inference process, potentially allowing unauthorized memory access.

An integer wraparound vulnerability in 32-bit PostgreSQL builds of pltcl and plperl enables authenticated attackers to cause undersized memory allocations and trigger out-of-bounds writes.

A vulnerability in PostgreSQL pg_dump allows a malicious superuser on an origin server to inject arbitrary code that executes during restoration on a client system via psql meta-commands.

A deserialization vulnerability in the Apache Airflow Task SDK allows remote code execution by importing arbitrary modules through a manipulated Callback object.

The MultiVendorX WordPress plugin contains a missing authorization vulnerability in its REST API, allowing authorized vendors to manipulate other vendors' store data.

Zimbra Collaboration (ZCS) is susceptible to remote code execution due to improper neutralization of OS commands.

GitPython is susceptible to OS command injection due to improper neutralization of special elements in kwarg values.

The User Registration & Membership WordPress plugin before 5.2.6 fails to enforce site registration settings, allowing unauthenticated users to create accounts when registration is disabled.

The frp reverse proxy is vulnerable to a denial of service attack via integer overflow and improper array index validation.

The Zalktis accounting application is vulnerable to SQL injection via malicious text fields within received electronic invoices.

A privilege escalation vulnerability in the Aonetheme Service Finder Booking WordPress plugin allows authenticated subscribers to elevate their privileges to higher roles.

ManageEngine Password Manager Pro and PAM360 are vulnerable to authentication bypass due to improper SAML signature verification, allowing unauthorized access to the application.

An improper privilege management vulnerability in IBM i versions 7.3 through 7.6 could allow an unauthenticated attacker to gain unauthorized system access.

A stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to execute arbitrary code via the setMacQos function.

A stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to execute arbitrary code via the setParentalRules function.

A stack-based buffer overflow in the setMacFilterRules function of the TOTOLINK A800R router allows remote code execution via manipulation of the Comment argument.

A stack-based buffer overflow in the UploadCustomModule function of the TOTOLINK A800R router allows remote code execution via manipulation of the File argument.

A stack-based buffer overflow in the setIpQosRules function of the TOTOLINK A800R router allows remote code execution via manipulation of the Comment argument.

A stack-based buffer overflow in the Tenda G0 httpd web management interface allows remote attackers to execute arbitrary code via the addStaticRoute function.

A remote buffer overflow vulnerability in the Tenda G0 web management interface allows code execution via the setPortMapping function in /goform/module.

A stack-based buffer overflow in the Tenda AC1206 web interface allows remote attackers to execute arbitrary code via the set_device_name function.

The Tenda AC1206 router is vulnerable to a stack-based buffer overflow, allowing memory corruption via specifically crafted input.

Tenda G0 devices are vulnerable to a stack-based buffer overflow, which can lead to memory corruption and potential system compromise.

Budibase is vulnerable to improper privilege management and authorization flaws, allowing authenticated users to perform unauthorized actions within the low-code platform.

IBM Documentation Offline is susceptible to improper output neutralization for logs, which may allow an attacker to inject malicious data into log files.

IBM i contains a vulnerability related to improper privilege management that may allow a local authenticated user to escalate privileges or impact system security.

IBM i is affected by an out-of-bounds write vulnerability that could potentially allow an authenticated remote attacker to execute arbitrary code or cause a system crash.

IBM i is susceptible to an external control of file name or path vulnerability, which may allow an authenticated local attacker to manipulate file operations.

IBM i contains an out-of-bounds write vulnerability in the 5770-JV1 component, which could allow an authenticated local user to execute arbitrary code or cause system instability.

IBM i is affected by an untrusted search path vulnerability, which could allow an authenticated user to achieve arbitrary code execution via manipulated search paths.

IBM i is susceptible to an improper privilege management vulnerability, which could allow a low privileged authenticated user to elevate their privileges within the system.

IBM i contains an out-of-bounds write vulnerability that could be exploited by an authenticated attacker to execute arbitrary code or cause a system crash.

The PostGIS address_standardizer extension contains an out-of-bounds write vulnerability that can be triggered during address standardization processes.

The Silabs WiseConnect platform fails to include maximum encryption key size information in SMP security requests, leading to potential weaknesses in Bluetooth Low Energy pairing.

A vulnerability in Silicon Labs WiseConnect allows unauthenticated attackers to spoof bonded devices, forcing RS9116W or SiWx917 hardware to re-pair with a rogue device.

A vulnerability in Silicon Labs WiseConnect allows Bluetooth re-pairing with existing devices to occur at a lower security level, facilitating potential authentication bypass.

A vulnerability in Silicon Labs WiseConnect allows re-pairing with a lower security level, making the Long Term Key (LTK) susceptible to brute-force attacks.

A memory handling vulnerability in the Linux kernel KVM subsystem for s390 architecture allows for improper AISB location management when registering IRQs without a summary bit.

The ClaudeHookBridge component in Network-AI allows for a deny-pattern bypass via truncation, enabling unauthorized access to restricted network pathways.

The SandboxPolicy component in Network-AI contains a blocklist bypass vulnerability caused by a quote mismatch during input processing.

The fast-xml-parser library is vulnerable to XML Entity Expansion, which could allow an attacker to cause a denial of service via specially crafted XML input.

Absolute Security Secure Access servers prior to version 14.57 contain an out-of-bounds read vulnerability that could lead to system instability or information disclosure.

The sigstore fulcio certificate authority is vulnerable to Server-Side Request Forgery, which could allow unauthorized certificate issuance.

IBM Security Verify Access and Identity Access are susceptible to a format string vulnerability that could allow an authenticated administrator to compromise the system.

An OS command injection vulnerability in NVIDIA LXD instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives.

A cross-site scripting vulnerability exists in GitLab CE/EE that allows a logged-in user to execute arbitrary scripts in the context of the victim's session.

A cross-site scripting vulnerability in GitLab CE/EE allows an authenticated attacker to execute arbitrary malicious scripts in the context of a victim's session.

A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin allows authenticated attackers to inject arbitrary HTML via the before_html field.

Eclipse RDF4J fails to restrict XML External Entity (XXE) processing in several XML parser entry points, allowing unauthorized data access via external entity references.

JupyterLab is vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input and output encoding, allowing attackers to execute arbitrary scripts in a user's browser session.

The FreePBX backup module contains an access control vulnerability that allows authenticated users with high privileges to perform unauthorized actions due to improper privilege management.

The FreePBX framework is susceptible to external control of system configuration settings, which allows low-privileged users to modify critical system parameters.

IBM i 7 contains an out-of-bounds write vulnerability that could allow an unauthenticated remote attacker to cause a system crash or potentially execute arbitrary code.

IBM i 7 is susceptible to an out-of-bounds write vulnerability that may allow unauthenticated remote attackers to disrupt services or compromise system memory.

Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks.

Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions.

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock.

An issue in OhSoft CoffeeZip v4.

An issue in Unistal Systems Pvt.