AISLE CVE Discoveries

Heap out-of-bounds write in the linux kernel rpc-over-rdma server reply path...

Code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Command injection in rpmuncompress via unescaped filenames passed to popen()

Command injection in rpmbuild via unescaped tarball path

Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Buffer overflow in strfmon and strfmon_l right-justification padding

EUC_JISX0213 decoding may hang on crafted input

SHIFT_JISX0213 decoding may hang on crafted input

Stack-based out-of-bounds write in tdelete during tree rebalancing

AT_SECURE program buffer overflow via $ORIGIN processing

Denial of service via unbounded connection thread spawning

Arbitrary file ownership change via symlink following in privileged paste

Local attacker can hijack file ownership via symlink race

Arbitrary file ownership and permission modification via symlink race condition

Dnial of service in `cockpit-ws` due to url-root handling without a trailing slash

Sensitive data exposure via command-line arguments

Sensitive data exposure of guest credentials via json argument in process list

Information disclosure of rhsm offline token via process arguments

Integer overflow in `do_lastlog()` offset calculation can misaddress `lastlog` entries on ilp32 builds

Excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Denial of service due to out-of-bounds read/write in remap engine

OpenSSL pinning bypass

wolfSSL CA-cache hit overrides callback

native CA store conn reuse

domain-scoped PSL domain cookie

secure cookie attribute bypass with tab

OpenSSL provider use-after-free

Out-of-bounds read in libXi's XI2 class parser

Out-of-bounds read in libXi's XListInputDevices() class parsing

Out-of-bounds read in libXi's XListInputDevices()

Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing

Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()

Out-of-bounds read in libXi's XQueryDeviceState()

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici vulnerable to caching and replay of unsafe HTTP method responses

Command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Missing Authorization via asset-history CSV importer

License Key Exposure via CSV Export

Information Disclosure via Custom Fields

Authorization Bypass via Importer

NULL Pointer Dereference via Fast I/O

phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

Local denial of service via blocking ipc send operations

Denial of service due to null pointer dereference in pam responder

Fail-open in ldap ppolicy access check allows continued authorization

Denial of service in nss responder via crafted zero-length requests

Denial of service via malformed pam v1 requests

OOB read in nss service request parsers

Denial of service via stack buffer overflow in scsi vpd page parsing

toctou symlink race in `g_file_create_replace_destination` fallback path

FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing

FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

ppp(8): missing length validation in mp_SetEnddisc()

ppp(8): missing length validation in LcpDecodeConfig()

ppp(8): incorrect length calculation in mp_Enddisc()

Buffer overflow in libalias RTSP handler

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 Open Redirect via Return-to Path

Authentication Bypass via LDAP

2FA Bypass via Remember-Me Cookie

Remote code execution via crafted mail headers

SSRF in modcss

Uncontrolled Resource Consumption in XmlTreeBuilder

pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-core before 6.5.6 Open Redirect via Backslash Logout

Heap-based Buffer Overflow in Wireshark

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

Stack-based Buffer Overflow in Wireshark

Out-of-bounds write in BLF file parsing

Out-of-bounds Read in Wireshark

Out-of-bounds Read in Wireshark

NULL Pointer Dereference in Wireshark

Use After Free in Wireshark

Use of Uninitialized Variable in Wireshark

Out-of-bounds Read in Wireshark

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

NULL Pointer Dereference in Wireshark

Reachable Assertion in Wireshark

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Unauthenticated DoS in via unbounded request body read

Unauthenticated DoS in `/ipa/migration/migration.py` via unbounded request body read

Null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Authenticated DoS in `otptoken-add` via unbounded otp key decoding/re-encoding

Unbounded peer-controlled json parameters enables remote denial of service via resource exhaustion

Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

Memory corruption from uncanceled AIO requests in the one-shot AIO error path

IV reuse across chunks in one-shot symmetric cipher operations on large inputs

Infinite wait loop in _kcapi_aio_read_all() when reusing an AIO handle after an error

Consecutive topic wildcards cause combinatorial routing work

Descriptor prefix collision in the AMQP 1.0 parser lets stored messages crash consumers

Stored HTML Injection in RabbitMQ Management OAuth Error Handling

OAuth credential refresh retains revoked runtime tags

Inapplicable PUBLISH property disconnects matching subscribers

Symlink-following chown allows local privilege escalation via pid file path manipulation

PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

Unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Privileged file corruption and denial of service via insecure temporary file handling

Integer underflow in iscsiuio ipv4 dhcp parsing

Integer underflow in iscsiuio dhcpv6 parsing

Denial of service in iscsiuio router advertisement parsing

Stack out-of-bounds read in s_vlog() when handling oversized log messages

SOCKS proxy localhost restriction bypass via IPv4-mapped IPv6 and unspecified addresses

Insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

Authorization Bypass via clonetasks Mass Action

Local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Use-after-free in HTTP/2 stream-dependency handling after curl_easy_reset()

Double free of the GSASL context during SASL authentication cleanup

Password for another .netrc user sent when the URL specifies only a username

Connection reuse ignores changed client certificate and private key TLS options

Known-host key type mismatch silently accepted via the CURLOPT_SSH_KEYFUNCTION callback

Use-after-free when curl_easy_pause() is called from the socket callback

Site-scoped capability check in nf_delete_all_data enables network-wide data deletion

Unauthenticated stored XSS via crafted Repeatable Fieldset submission indexes

Payment total tampering via fail-open get_calc_value() in ListSelect and ListRadio fields

Missing authorization in the submissions-table block exposes form submissions to visitors

Validation bypass via client-controlled field metadata in the AJAX submission handler

Out-of-bounds read and write in the ADX audio decoder via a mid-stream channel layout change

Double free in the NVDEC hardware decoder when no decoder surfaces remain

Stack buffer overflow in the Vulkan HEVC decoder via oversized vps_num_hrd_parameters

Heap buffer overflow in the VobSub subtitle demuxer via excessive distinct stream IDs

Infinite loop in rtp_asf_fix_header() via an undersized ASF chunksize

Out-of-bounds read in the S/PDIF muxer via an oversized DTS core_size value

Privilege escalation to administrator via unvalidated usergroup role assignments

Cross-tenant private SSH key disclosure via taxonomy scoping bypass

Authorization bypass lets host editors retarget lookup value overrides to other hosts

Cross-tenant infrastructure metadata disclosure via unvalidated IDs in taxonomy_scope

Missing Kerberos principal check in the gssapi-keyex path allows login as arbitrary users

Unbounded memory growth in SFTP clients from responses with unknown request IDs

Infinite loop in automatic certificate authentication leading to denial of service

Stack exhaustion via uncontrolled recursion when applying crafted JSON Patch documents

Exponential runtime in cJSON_Compare() on deeply nested JSON, leading to denial of service

Non-atomic JSON Patch application destroys target document members on failed operations

OAuth2 PKCE bypass via unpersisted S256 code_challenge_method during authorization

Argument injection in the APT backend via crafted package names leading to root code execution

Missing connection throttling in the system-mode RDP listener allows unauthenticated DoS

Stack buffer overflow verifying EdDSA PGP signatures with mismatched MPI lengths

Stack buffer overflow in rpcinfo's rpcbdump() when formatting remote version lists

Stack buffer overflow in rpcinfo's rpcbaddrlist() via a malicious rpcbind server

Infinite loop and out-of-bounds read via a zero-length option in IPv6 Router Advertisements

Inverted IP SubjectAltName comparison in the OpenSSL backend skips authenticity checks

Permission check bypass in channelUpdate via all([]) lets anonymous users modify channels

Out-of-bounds read parsing FTP directory listings leaks memory from other transactions

Controller-side file disclosure via tampered Leapp report content during remediation

Insecure permissions on the PostgreSQL data backup archive expose data to local users

XSS via missing escaping in the generic image output layout

NULL pointer dereference in the SSH protocol dissector

Code injection via the mf command

Reachable assertion in HeifContext::get_track() when opening an empty HEIF sequence file

Use-after-free in mod_ldap with per-directory configuration

XSS in mod_proxy_ftp's FTP directory listing generation

Argument injection in the CONNECT engine's curl command line via the table HTTP attribute

Authorization bypass exposes stored routine definitions to role-granted EXECUTE users

Integer overflow in remote message decompression crashes the CIB remote listener

Integer overflow in SplashOutputDev::tilingPatternFill leading to heap buffer overflow

Stack buffer overflow in rrdcached via an oversized CREATE request

Stored XSS in the prescription multi-print view via patient demographic fields

Unbounded memory request in AcquireAlignedMemory leading to out-of-memory condition

Missing check in the DCM decoder allows images with invalid dimensions, causing crashes

NULL pointer dereference during OCSP chain checking with partial-chain verification

Double free in the TLS client when checking a crafted OCSP stapled response

Command injection via crafted DHCP options allows root code execution in the initramfs

Unauthenticated disclosure of the Active Directory default join password via adInfo()

SQL injection during profile field migration via user-supplied profile field data

Double free in parse_def() when parsing nested compound configuration blocks

Out-of-bounds read in sh_disassemble when disassembling crafted SH2A bytecode

Heap buffer overflow in set_reg_n when disassembling crafted SH2A FPU bytecode

SSO enforcement bypass via the API lets SSO users create local password credentials

Use-after-free in gnutls_pkcs11_token_set_pin() with a NULL old PIN

Authentication bypass via NUL character in RSA-PSK usernames

Certificate validation falls back to Common Name checks on an oversized SAN

Heap overread in RSA key exchange with a PKCS#11-backed key via a short premaster secret

Denial of service via duplicate sequence numbers in DTLS packet reordering

NULL pointer dereference in mod_dav_lock via a malicious request

Stack buffer overflow in libcasper via file descriptors exceeding FD_SETSIZE in select()

Privilege widening in cap_net when keys omitted from a new limit default to allow-any

Heap overflow in FUSE_LISTXATTR handling via a non-NUL-terminated attribute list

SQL injection in logical replication via crafted table names at REFRESH PUBLICATION

Integer wraparound undersizes allocations, letting unprivileged users write out of bounds

Unauthenticated deletion of host AES keys and power schedules via clearAES and clearPMTasks

Stored XSS in the Inventory Report via unescaped option labels in selectForm()

Stored XSS in the Host Management page via the unauthenticated inventory endpoint

Stored XSS via unescaped inventory data in buildRow() on the Group Inventory tab

Heap buffer overflow when decompressing page data from crafted .solv files

Stack buffer overflow in the Debian metadata parser via SHA384/SHA512 checksum tags

Heap buffer overflow in repo_add_solv() via negative size values in a crafted .solv file

Unbounded resource allocation in mod_md when processing OCSP response data

NULL pointer dereference in mod_authn_socache in caching forward proxy configurations

Owner-scope role restrictions not enforced on API v2 endpoints, exposing other users' data

Stored XSS in the project selector via unsanitized project names

Command injection in rpmuncompress via an archive's top-level directory name

WORM protection bypass in vfs_worm via rename over a protected file

Cross-site scripting via improper neutralization of input during web page generation

XSS in the multilingual associations component due to missing output escaping

Command injection in the netrw plugin via crafted sftp:// and file:// URLs

Infinite loop in the GnuTLS backend on circular certificate chains leading to denial of service

Memory corruption when processing crafted web content leading to a process crash

Off-by-one stack write in establish_proxy_connection() via a malformed HTTP proxy response

Stored XSS via package metadata rendered unescaped in href attributes

Missing CSRF protection allows cross-site package uploads and admin actions

Authentication bypass for ScriptAlias CGI scripts via a mod_auth/mod_cgi path mismatch

OCSP designated-responder authorization bypass via missing signature verification

Predictable DNS transaction IDs in the inet_res resolver enable cache poisoning

Out-of-bounds read via integer underflow when reassembling zero-length DTLS fragments

Name constraints bypass via case-sensitive dNSName and rfc822Name comparison

Revoked server certificates accepted via crafted multi-record OCSP response

Unbounded PGP AEAD chunk size allows pre-authentication resource exhaustion

Use-after-free in client-side DANE TLSA certificate checking

NULL pointer dereference when processing CMS KeyTransportRecipientInfo

NULL pointer dereference when processing CMS KeyAgreeRecipientInfo

NULL pointer dereference when processing a delta CRL missing the CRL Number extension

Out-of-bounds read when processing partial AES-CFB128 blocks on AVX-512 systems

Heap buffer overflow in dhclient's environment array resizing via a crafted packet

dhclient.conf directive injection via the BOOTP file field, leading to root code execution

Stack buffer overflow in libnv via file descriptors exceeding FD_SETSIZE in select()

Resource exhaustion in the Group Replication plugin leading to denial of service

Hang or repeatable crash in the Group Replication plugin

Hang or repeatable crash in the Group Replication plugin

Stack overflow via alloca in the caching_sha2_password authentication plugin

Out-of-bounds stack read in wolfSSHd on Windows when handling terminal resize requests