TheNote
CERT Recently Published Vulner... Note
GooglePlay AppStore

CERT Recently Published Vulnerability Notes

kb.cert.org/vuls is a webpage maintained by the Carnegie Mellon University Software Engineering Institute (SEI) which provides a publicly accessible database of known software vulnerabilities. It lists a vast amount of vulnerability information including identifiers, descriptions, severity ratings, and potential impacts, helping users stay informed about potential security risks.
CERT Recently Published Vulnerability Notes kb.cert.org
RSS kb.cert.org
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

VU#564823: GNU Wget enables SSRF via unvalidated FTP PASV IPs

GNU Wget versions 1.25.0 and earlier have a server-side request forgery vulnerability. This flaw exists in the implementation of FTP passive mode. Wget fails to properly validate IP addresses received in PASV responses from an FTP server. An attacker can control an FTP endpoint and redirect Wget's connection to any IP address. This allows bypassing network access controls to reach internal hosts and services. The vulnerability is similar to previous FTP PASV issues. A malicious FTP server or a redirecting HTTP server could exploit this. The impact includes retrieving service banners or accessing internal endpoints. Applications embedding Wget are especially vulnerable due to automated request handling. GNU has fixed this vulnerability in a recent update. Users should update to a patched version of GNU Wget.
https://kb.cert.org/vuls/id/564823 kb.cert.org
RSS Hunter RSS Hunter • Yesterday

VU#152953: PayRange Android app version 7.0.7 contains multiple vulnerabilities

PayRange is a mobile payment application designed for use with unattended machines like vending machines and laundromats. It allows users to make payments using their smartphones via Bluetooth. A critical vulnerability was identified in version 7.0.7 of the PayRange Android application. This vulnerability stems from two distinct security flaws. The first flaw (CVE-2026-13462) concerns the app's handling of SSL certificates within its WebViews. Specifically, the PayRange app incorrectly accepts invalid SSL certificates. The second vulnerability (CVE-2026-13461) permits JavaScript injection. This injection can lead to escaping the WebView sandbox, enabling malicious actions on the user's device. Attackers can exploit these vulnerabilities through on-path interception. They can redirect user traffic to their own controlled device. By presenting a trusted certificate matching specific rules, they can initiate a TLS connection. This allows them to inject content, harvest credentials, and execute unauthorized requests. For machine operators, this could extend to issuing commands to PayRange hardware with full operator permissions. Unfortunately, the vendor could not be reached to coordinate a fix. Users are advised to apply any available software updates from their hardware or software providers.
https://kb.cert.org/vuls/id/152953 kb.cert.org
RSS Hunter RSS Hunter • Jul 9

VU#734812: Xerte Online Toolkit contains an authentication bypass that allows for RCE

Two critical vulnerabilities have been identified in Xerte Online Toolkits, an open-source e-learning authoring tool. The first vulnerability, CVE-2026-14261, allows unauthenticated attackers to gain administrative access. This is achieved by exploiting the persistent /setup/ directory after installation. Attackers can reconfigure the application to connect to a remote database they control. Subsequently, an attacker with administrative privileges can exploit CVE-2026-12116. This second vulnerability involves an editable antivirus binary path within the tool's settings. By redirecting this path to a PHP interpreter, uploaded files can be executed as PHP code. This leads to remote code execution on the affected server. The impact of these vulnerabilities includes persistent access, data exfiltration, and potential supply chain attacks. Xerte Online Toolkits v3.15.5 or v3.14.6 includes fixes for these issues. Users should manually remove the /setup/ folder and upgrade to the patched versions. The fixes involve automatically removing the /setup/ directory and securing sensitive configuration files.
https://kb.cert.org/vuls/id/734812 kb.cert.org
RSS Hunter RSS Hunter • Jul 9

VU#849433: Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls

Adalo's no-code application platform has a significant security flaw that exposes complete user records through its database API for all applications built on both V1 and V2. This issue affects over one million applications, putting developers and their end users at risk of data exposure. The problem arises from a platform-level flaw that allows authenticated users to retrieve full user data belonging to any Adalo application, regardless of configuration. Adalo is a Software-as-a-Service provider for building no-code applications, and each application is supposed to be logically isolated with separate databases, users, and configurations. However, the Adalo database API contains a flaw that allows the backend to return complete user records for every list component request, regardless of which fields the component is configured to display. The database does not enforce ownership-aware, server-side authorization checks, allowing authenticated users of any Adalo application to query database and table identifiers belonging to other applications and retrieve full records. Additionally, Adalo's use of long-lived JWT tokens, which remain valid for approximately twenty days, allows attackers to reuse these tokens to query the database API directly and extract large volumes of user data. The combination of exposed tokens, permissive CORS behavior, and large response limits enables persistent, automated harvesting of entire user databases using only a single token obtained from any visitor session. The vulnerabilities affect all Adalo applications across both V1 and V2, and customers and tenants should assume that data in Adalo collections may be exposed and avoid storing sensitive information there until a patch is deployed. Adalo has acknowledged the issue, but no patch is currently available, and users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.
https://kb.cert.org/vuls/id/849433 kb.cert.org
RSS Hunter RSS Hunter • Jul 8

VU#213560: Tenda firmware (multiple versions) contains hidden authentication backdoor

Multiple Tenda firmware versions contain a critical undocumented authentication backdoor. This vulnerability, identified as CVE-2026-11405, allows attackers to bypass password verification entirely. The backdoor resides within the /bin/httpd web server binary's login function. It first attempts standard MD5 password verification. If that fails, it retrieves a secret password from the device configuration. The system then performs a direct plaintext comparison of the entered password against this secret value. Crucially, the username is never validated in this backdoor path. Successful exploitation grants full administrative access, overriding any configured credentials. Attackers can then reconfigure the device, modify network settings, and disable security measures. As of now, Tenda has not provided a patch for this vulnerability. Mitigation strategies include disabling remote management and restricting local network exposure by changing the default LAN IP address.
https://kb.cert.org/vuls/id/213560 kb.cert.org
RSS Hunter RSS Hunter • Jul 6

VU#828543: HP Deskjet 2800 Printer Series Webservers contain Missing Authorization Vulnerability

HP Deskjet 2800 Series printers with firmware version TBP1CN2612AR or earlier have a critical authorization vulnerability. This flaw, tracked as CVE-2026-13753, allows unauthenticated access to the printer's web server API. Attackers can bypass normally required administrator credentials to obtain sensitive data. This exposed information includes Wi-Fi Direct credentials, management configuration details, and security-related data. The affected API endpoints do not validate session state or authentication before disclosing this information. Directly requesting data from these backend APIs bypasses the web interface's security measures. Exposed data could enable unauthorized wireless access and further network compromise. Unfortunately, HP has not yet released a firmware patch for this vulnerability. Users are advised to restrict network access to the printer's web interface and disable unnecessary features like Wi-Fi Direct and SNMP. Implementing firewall rules and access control lists is also recommended to mitigate risks.
https://kb.cert.org/vuls/id/828543 kb.cert.org
RSS Hunter RSS Hunter • Jul 6

VU#639124: Multiple local privilege escalation vulnerabilities in Little Orbits GameFirst Anti-Cheat

The GamersFirst Anti-Cheat driver, GFAC.sys, suffers from critical security flaws. These vulnerabilities allow local attackers to escalate privileges and cause denial-of-service conditions. The issues stem from the driver's insecure handling of user-controlled input via a minifilter communication port. A NULL pointer dereference in the initialization and request handling logic can lead to system crashes. Additionally, the minifilter communication port lacks sufficient security descriptors, enabling low-privileged users to connect. This allows them to access functions not intended for them. The driver also fails to validate user-supplied memory addresses during write operations. This enables arbitrary kernel memory writes, a "write-what-where" condition. Exploiting this can lead to privilege escalation to SYSTEM by modifying critical operating system structures. The vendor was unresponsive regarding these disclosed vulnerabilities. Users are advised to restrict local access and monitor for suspicious activity involving GFAC. Disabling or removing games that use GFAC is recommended until a patch is released.
https://kb.cert.org/vuls/id/639124 kb.cert.org
RSS Hunter RSS Hunter • Jul 2

VU#936962: Multiple file parsing vulnerabilities in FastStone Image Viewer 8.3.0.0

Two vulnerabilities have been identified in FastStone Image Viewer 8.3. These flaws could allow for remote code execution or control-flow corruption. The issues affect the JPEG 2000 (JP2) parser and the PSD file parser. Attackers can exploit these by tricking the application into processing malicious image files. A heap-based buffer overflow in the JP2 parser, CVE-2026-30040, can be triggered by a malformed QCD marker. This allows arbitrary code execution, even without the user opening the file directly, if it's in the thumbnail enumeration range. An integer overflow in the PSD parser, CVE-2026-30041, results from improper height validation. This can lead to a heap-based buffer overflow, enabling code execution or denial-of-service. Exploitation could grant attackers arbitrary code execution in the user's context. The severity increases with the user's privileges. A patch is not yet available, and the vendor could not be reached for coordination. Users are advised to run the software with restricted accounts and block downloads of JP2 or PSD files from untrusted sources.
https://kb.cert.org/vuls/id/936962 kb.cert.org
RSS Hunter RSS Hunter • Jun 22

VU#226679: Microsoft WinRE allows for bypass of UEFI/BIOS password enforcement

The Windows Recovery Environment (WinRE) in Windows 10 and 11 can be exploited to bypass UEFI/BIOS firmware security controls. Attackers with physical or administrative access can leverage WinRE's alternate boot path. This path may not enforce the same security measures applied during a normal boot. Specifically, administrative UEFI/BIOS passwords might not be enforced during certain recovery operations. This vulnerability is similar to "Evil Maid" attacks, where physical access is used to alter security settings. The UEFI BootNext variable, which can be set to override the standard boot order, is not authenticated and can be exploited. While Secure Boot validates signed applications, the UEFI specification doesn't mandate a full reset after BootNext is set. This allows bypassing pre-boot security like passwords and potentially BitLocker. Organizations with high security needs should implement additional controls beyond just UEFI/BIOS passwords. Microsoft has released advisories and mitigations for WinRE-related vulnerabilities. Recommended solutions include disabling WinRE if not needed, requiring administrative authorization for recovery, and enabling BitLocker with TPM and PIN or startup key. Restricting pluggable media, EFI System Partitions, and UEFI NVRAM modifications are also advised. Deploying EDR solutions for pre-boot security and implementing robust physical security controls are crucial for highly sensitive systems.
https://kb.cert.org/vuls/id/226679 kb.cert.org
RSS Hunter RSS Hunter • Jun 22

VU#457458: Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Multiple vendor-signed UEFI applications are susceptible to a Secure Boot bypass attack. This exploit allows attackers to execute arbitrary code during the early pre-boot phase. The vulnerability leverages "Bring Your Own Vulnerable Driver" (BYOVD) techniques. If a system trusts the vendor's certificate, attackers can compromise the firmware before the operating system loads. The UEFI standard requires signed applications and drivers for Secure Boot. Attackers can exploit UEFI applications with specific functionalities to circumvent these security policies. Researchers identified various UEFI applications from vendors like Acer, AMD, and ASUS as vulnerable. These applications possess capabilities to manipulate memory or load raw drivers. The impact is significant, allowing for persistent platform compromise and evasion of security tools. To mitigate this risk, system administrators must update the UEFI Forbidden Signature Database (DBX). This action revokes trust in the vulnerable binaries. Additionally, applying vendor-provided firmware and software updates is crucial. These updates replace vulnerable applications with secure versions. Updating the DBX prevents the execution of these compromised applications.
https://kb.cert.org/vuls/id/457458 kb.cert.org
RSS Hunter RSS Hunter • Jun 18

VU#380058: SignalRGB kernel driver contains improper access control and IOCTL vulnerabilities

The SignalRGB kernel driver, SignalIo.sys, contains two critical security vulnerabilities related to improper access control and unsafe memory handling. The driver's device object is created with overly permissive access controls, allowing any local user to interact with privileged hardware operations via input/output control commands. Seven of the driver's IOCTL handlers also suffer from a NULL pointer dereference vulnerability. This occurs because the driver fails to check if a buffer pointer is null before dereferencing it. Sending an IOCTL with an empty input buffer triggers this condition. Exploiting these flaws enables unprivileged users to gain access to sensitive driver functions, including read and write access to PCI configuration space. Furthermore, an authenticated local attacker can intentionally crash the kernel by exploiting the NULL pointer dereference. The SignalRGB driver version 1.3.7.0 has addressed these security weaknesses. Organizations are advised to update to this patched version and implement mitigations for Bring Your Own Vulnerable Driver attacks. These mitigations include restricting administrative privileges and enforcing driver block rules.
https://kb.cert.org/vuls/id/380058 kb.cert.org
RSS Hunter RSS Hunter • Jun 17

VU#862559: crypton-x509-validation Haskell libraries do not enforce X.509 NameConstraints

A significant vulnerability has been discovered in the Haskell TLS software stack affecting applications built with the Haskell programming language. The specific library "crypton-x509-validation" fails to enforce the NameConstraints security feature. NameConstraints, defined in RFC 5280, are crucial for controlling which domains a certificate authority can issue certificates for. This oversight allows an attacker who compromises a sub-CA to issue certificates for domains beyond their intended scope. Consequently, these malicious certificates will be accepted by any vulnerable Haskell TLS connection. This enables an attacker to gain full visibility into encrypted sessions. The impact of this vulnerability can lead to the theft of sensitive financial information and credentials. Industries utilizing delegated Public Key Infrastructure structures are particularly at risk. Versions prior to 1.9.1 of crypton-x509-validation are affected. A fix is available in version 1.9.1 of the crypton-x509-validation library. Users are strongly advised to update to the patched version immediately to mitigate this security risk. The vulnerability is tracked as CVE-2026-9648.
https://kb.cert.org/vuls/id/862559 kb.cert.org
RSS Hunter RSS Hunter • Jun 11

VU#616257: Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass

Microsoft is revoking trust for older versions of the open-source shim bootloader due to a Secure Boot bypass vulnerability. This vulnerability allows attackers to execute arbitrary code early in the boot process, circumventing security measures. The affected shim bootloaders, primarily versions 0.9 and earlier, will be added to the Microsoft UEFI Forbidden Signature Database (DBX). Once the DBX is updated, these bootloaders will be disallowed from running.The shim project facilitates Secure Boot for Linux distributions by acting as a bridge between firmware and the operating system. However, vendors who forked older, vulnerable versions without updating created a persistent supply chain risk. Researchers identified specific vulnerable shim bootloaders from various vendors, including Red Hat, baramundi, and Oracle.Exploiting this flaw enables attackers with boot modification privileges to gain persistent control, potentially loading unsigned kernel components that survive reboots. These malicious components can evade operating system security and endpoint detection solutions. To mitigate this, users must apply the latest vendor software and bootloader updates.Additionally, applying Microsoft's DBX update is crucial to block vulnerable bootloaders. Enterprises and developers should test these updates thoroughly before widespread deployment. It is recommended to update the authorized signature database (DB) before applying DBX revocations. Tools are available to audit and verify DBX updates and identify revoked boot components.
https://kb.cert.org/vuls/id/616257 kb.cert.org
RSS Hunter RSS Hunter • Jun 9

VU#595768: Securly Chrome Extension contains multiple weak encryption and access control vulnerabilities

Version 3.0.7 of the Securly Chrome Extension has several critical security flaws. These vulnerabilities include insecure data transmission over HTTP for sensitive filtering rules. Weak cryptography is used, as evidenced by hardcoded plaintext AES passphrases and an outdated key derivation method. Improper access control allows unauthenticated access to protected resources and sensitive configuration data. An attacker could exploit these weaknesses to steal filtering information. They might also induce a Denial of Service by manipulating downloaded configuration files. Furthermore, attackers could modify content blocking rules for student users. One vulnerability involves a dynamically registered content script that bypasses security reviews. This script can hide all page content indefinitely if Securly's servers are unreachable. The extension also uses deprecated SHA-1 hashing for critical URL matching. While Securly has not been reached for a patch, administrators can mitigate risk by restricting extension use on untrusted networks and utilizing school-managed VPNs.
https://kb.cert.org/vuls/id/595768 kb.cert.org
RSS Hunter RSS Hunter • Jun 3

VU#615987: Missing IPsec Integrity Protection for IMS SIP Signaling in Verizon VoLTE Deployments

Verizon's VoLTE service on its IMS network has been operating without essential SIP integrity protection. This means that sensitive signaling data, including call setup information, is transmitted unencrypted. On-path attackers can therefore intercept and modify this traffic without detection. The absence of IPsec ESP encapsulation and specific security headers leaves the signaling vulnerable. While recent iOS carrier bundle updates contain IMS IPsec settings, their active implementation remains unconfirmed. This lack of protection allows for significant security risks like call hijacking and denial-of-service attacks. Specifically, REGISTER exchanges were observed missing crucial security headers. According to industry standards, SIP signaling between devices and the network should be protected. Verizon had initially committed to addressing the issue but has since disengaged from coordination efforts. Without verifiable evidence of mitigation, the security exposure continues. Remediation requires both network-side enablement by Verizon and device-side configuration updates. Until confirmed, VoLTE signaling should be treated as untrusted.
https://kb.cert.org/vuls/id/615987 kb.cert.org
RSS Hunter RSS Hunter • Jun 2

VU#265691: Appsmiths SQL Query autocomplete renderer contains a cross site scripting vulnerability

A stored cross-site scripting (XSS) vulnerability, CVE-2026-7299, exists in Appsmith's CodeMirror based SQL query editor autocomplete. Attackers with developer access to a shared PostgreSQL datasource can inject JavaScript into malicious database object names. This payload executes when any workspace member triggers SQL autocomplete. Successful exploitation allows arbitrary JavaScript execution in the victim's browser. This can lead to session hijacking, privilege escalation, or credential theft. Appsmith is an open-source, low-code platform for building internal tools. The vulnerability specifically affects the autocomplete function's handling of database object names. The failure to sanitize these names allows for persistent XSS injection. Version 2.1 of Appsmith addresses and fixes CVE-2026-7299. Users are strongly advised to update their Appsmith installations promptly.
https://kb.cert.org/vuls/id/265691 kb.cert.org
RSS Hunter RSS Hunter • Jun 2

VU#873170: Collibra Agent contains improper authentication and path traversal vulnerabilities

The Collibra Platform Agent contains chained vulnerabilities allowing remote code execution. A remote, unauthenticated attacker can exploit these by uploading a crafted ZIP archive. This archive exploits a Zip Slip vulnerability during extraction, enabling path traversal. Specifically, the POST /rest/restore endpoint fails to validate extracted file paths. Attackers can use directory traversal sequences to write files to arbitrary locations on the server. One exploitation path involves placing a malicious JavaServer Pages file in a web-accessible directory. This leads to remote code execution when the file is accessed via HTTP. Privileged REST endpoints under /rest/* also lack proper authentication and authorization. These exposed endpoints can be used to gather information for further exploitation. The web services for these endpoints bind to all network interfaces, potentially increasing exposure. Successful exploitation allows attackers to install web shells, manipulate data, disrupt availability, and pivot into the network. Collibra has released updated versions to address these vulnerabilities. Users are strongly advised to update to the fixed releases promptly. Administrators should restrict access to exposed REST endpoints and management interfaces.
https://kb.cert.org/vuls/id/873170 kb.cert.org
RSS Hunter RSS Hunter • Jun 2

VU#158530: PCTCore64.sys Windows kernel driver contains missing access control vulnerability

The PCTCore64.sys Windows kernel driver from PC Tools Internet Security has a significant security vulnerability. This driver exposes a device interface called \.\PCTCoreDriver without proper access control measures in place. Consequently, any user-mode process can interact with this driver and execute privileged IOCTL commands.In a Bring Your Own Vulnerable Driver (BYOVD) scenario, an attacker with the ability to load a Windows driver can exploit this flaw. They can perform sensitive low-level operations on the target system by invoking the driver's exposed interface. The driver lacks secure descriptor application, allowing unprivileged processes to open device handles and send privileged IOCTL requests.This allows attackers to perform actions like enumerating system-wide handles and manipulating handles across processes. Crucially, it enables credential extraction from sensitive processes like lsass.exe. Arbitrary process termination, including protected processes, is also possible.Although PC Tools Internet Security was discontinued in 2013, the driver remains signed and exploitable in BYOVD attacks. This vulnerability facilitates credential theft, disabling security software, and achieving broader system compromise. The impact includes credential theft, denial-of-service, and system compromise.The solution is to remove and block the vulnerable driver, as it is no longer maintained. Organizations should also implement mitigations against BYOVD attacks, such as restricting admin privileges and enabling Windows security features like HVCI and WDAC.
https://kb.cert.org/vuls/id/158530 kb.cert.org
RSS Hunter RSS Hunter • Jun 1

VU#780781: Casdoor contains multiple authentication bypass and access management vulnerabilities

Casdoor versions 2.362.0 and earlier are vulnerable to critical identity and access management flaws. These vulnerabilities enable wide-ranging authentication bypass and privilege escalation. Several CVEs detail flaws in Casdoor's SAML processing related to certificate handling, assertion validation, and replay protection. The social-login binding flow allows bypassing MFA requirements, and unverified email binding may lead to account takeover. Token exchange mechanisms contain flaws enabling cross-organization privilege escalation and lack of token revocation. Attackers can exploit these flaws to impersonate users, bypass MFA, and gain persistent unauthorized access. The vulnerabilities arise from issues like arbitrary certificate usage, missing audience restrictions, and the absence of SAML assertion replay protection. Time bounds in SAML assertions are not enforced, further increasing risk. The platform fails to verify the active status of tokens used for exchange. The SAML callback handler accepts unsolicited SAML responses, leading to session hijacking. The impact is significant, potentially allowing attackers to compromise accounts and escalate privileges. Currently, a patch from Casdoor is unavailable; therefore, users should implement strict identity protection.
https://kb.cert.org/vuls/id/780781 kb.cert.org
RSS Hunter RSS Hunter • May 28

VU#980487: Local privilege escalation in Linux Kernel (Dirty Frag)

The "Dirty Frag" vulnerability affects Linux kernel versions 4.10 and later, stemming from flawed handling of fragmented IPv4/IPv6 packets. It allows an attacker to manipulate fragment offsets, leading to memory corruption during reassembly. This vulnerability is a combination of two previously known ones, specifically related to xfrm-ESP and RxRPC page-cache writes. Successful exploitation can trigger a denial of service or, potentially, privilege escalation. The root cause lies in the kernel's insufficient validation of fragment metadata during the reassembly process, allowing for malformed sequences. The impact includes kernel panics, memory corruption, and container escapes. Immediate mitigation involves updating the Linux distribution's kernel package with patches. Workarounds include disabling the vulnerable modules (esp4, esp6, and rxrpc) or blacklisting them during boot. For containerized environments, additional mitigation strategies include seccomp filtering, AppArmor policies, and eBPF-based enforcement. The vulnerability was discovered and disclosed by Hyunwoo Kim, and the documentation was written by Bob Kemerer.
https://kb.cert.org/vuls/id/980487 kb.cert.org
RSS Hunter RSS Hunter • May 20

VU#777338: SGLang contains two remote code execution and one path traversal vulnerability

Three critical vulnerabilities have been identified in the SGLang project, a framework for serving large AI models. Two of these vulnerabilities allow for remote code execution (RCE), while the third is a path traversal flaw. Exploitation requires the multimodal generation mode to be enabled and an attacker to have network access to the SGLang service. Currently, no patch is available for these issues. The project maintainers did not provide a response during the coordination process. CVE-2026-7301 exploits a pickle.loads() sink in the multimodal generation runtime scheduler, allowing RCE when exposed. This vulnerability binds to all network interfaces by default, making it accessible. CVE-2026-7302 permits arbitrary file writes via path traversal in the multimodal generation runtime. Attackers can achieve this by manipulating upload filenames with directory traversal sequences. CVE-2026-7304 enables RCE through unauthenticated deserialization of Python objects via dill.loads() when custom logit processors are enabled. If exploited, these vulnerabilities could lead to remote code execution or arbitrary file writes on the SGLang host. The highest risk is to deployments exposing affected interfaces to untrusted networks. Until a patch is released, users should restrict service access and avoid exposing it to untrusted networks.
https://kb.cert.org/vuls/id/777338 kb.cert.org
RSS Hunter RSS Hunter • May 18

VU#471747: dnsmasq contains several vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation

Dnsmasq, a popular DNS and DHCP server, is vulnerable to several memory safety and input validation flaws. These vulnerabilities include heap buffer overflows, memory corruption issues, and potential code execution exploits. Attackers can exploit these flaws to compromise the system in various ways. Successful attacks can lead to DNS cache poisoning, causing traffic redirection to malicious sites. Other attacks can trigger denial-of-service conditions, rendering dnsmasq unusable. Information disclosure is also possible, potentially leaking sensitive network details. In certain scenarios, local attackers could even achieve root privilege escalation. The identified vulnerabilities are tracked under various CVE numbers, including CVE-2026-2291 and several others. Dnsmasq version 2.92rel2 has been released to address these issues. This update and vendor patches are key to mitigating the risks. The vulnerabilities were discovered by multiple researchers. Careful application of the patch is essential to maintain network security.
https://kb.cert.org/vuls/id/471747 kb.cert.org
RSS Hunter RSS Hunter • May 11

VU#937808: Casdoor contains Arbitrary File Write vulnerability

Casdoor, an IAM platform, suffers from an arbitrary file write vulnerability due to improper path sanitization. The vulnerability lies within the "Local File System" storage provider, allowing authenticated users with upload privileges to write files outside the intended storage directory. Attackers exploit the /api/upload-resource endpoint by manipulating the pathPrefix parameter, using directory traversal techniques. This allows them to create or overwrite files on the host system, bypassing security restrictions. Successful exploitation can lead to various impacts, including file overwriting, persistence mechanisms, and database corruption. The attacker needs an authenticated session and file upload permissions to leverage this vulnerability. The severity of the impact depends on the Casdoor service account's privileges. A pull request has been submitted to fix the path validation issue. Users are advised to limit administrative access, restrict filesystem permissions, and avoid using the Local File System provider. The vulnerability was discovered and reported by Danilo Dell'Orco.
https://kb.cert.org/vuls/id/937808 kb.cert.org
RSS Hunter RSS Hunter • May 11

VU#260001: Linux kernel contains local privilege escalation vulnerability (Copy Fail)

A new privilege escalation vulnerability, named "Copy Fail," has been found in Linux kernels 4.17 and later. This flaw, assigned CVE-2026-31431, allows local users to gain root access. The vulnerability stems from a logic error within the algif_aead module, used for authenticated encryption. An unprivileged user can write four controlled bytes to the page cache of any readable file. This in-memory modification can bypass integrity checks; the file remains unchanged on disk. Attackers can exploit this by targeting a setuid binary, altering its in-memory contents to escalate privileges. A public Python proof-of-concept exists, increasing the risk of exploitation. The solution involves applying upstream kernel patches that revert AEAD operations. Users should update their Linux distributions as soon as updates are available. Workarounds include disabling the algif_aead module or blacklisting its initialization. Containerized environments require additional mitigations like seccomp filtering, AppArmor policies, or eBPF-based enforcement. Virtualization does not allow the bug to be leveraged for host escape, due to memory isolation. The vulnerability was discovered by Theori and documented by Bob Kemerer and Vijay Sarvepalli.
https://kb.cert.org/vuls/id/260001 kb.cert.org
RSS Hunter RSS Hunter • May 8

VU#748485: Unauthenticated configuration modification vulnerability in Central Office Services - Content Hosting Component

A security flaw exists in the DRC INSIGHT software's configuration management endpoint. Unauthenticated users on the same network can modify the server's configuration file. This vulnerability, tracked as CVE-2026-5756, allows for potential data exfiltration, traffic redirection, or service disruption. The Central Office Services component of DRC INSIGHT, used to distribute testing content, exposes an administrative endpoint without proper authentication. Any device with network access can submit requests to this endpoint. Attackers could exploit this to redirect student data, such as test responses or audio recordings, to malicious external services. They might also intercept HTTPS traffic by inserting a malicious proxy setting. Malformed configuration changes could lead to service disruption, preventing the server from starting or interfering with active assessments. No patch is currently available from the vendor. Organizations should restrict network access to the COS server, placing it on an isolated network segment. Firewalls should limit access to the configuration endpoint, ideally to localhost or authorized administrative IPs. Outbound traffic should be restricted to approved destinations and monitored for suspicious activity. Administrators should enable logging and monitoring for requests to the configuration endpoint and unusual traffic patterns.
https://kb.cert.org/vuls/id/748485 kb.cert.org
RSS Hunter RSS Hunter • Apr 23

VU#518910: Ollama GGUF Quantization Remote Memory Leak

Ollama's model quantization engine has a critical heap memory vulnerability. An attacker can exploit this by uploading a malicious GGUF file. This crafted file triggers an out-of-bounds read in the quantization process. The vulnerability stems from a lack of bounds checking on tensor metadata from the GGUF file. Go's unsafe.Slice is then used to create memory slices exceeding valid data buffers. This allows attackers to access unintended heap memory. The leaked data is inadvertently written into a new model layer. Ollama's registry API can then be used to exfiltrate this sensitive heap data. This can lead to unauthorized access, data exposure, and potential system compromise. A patch is not yet available, but restricting model upload access is a recommended interim solution.
https://kb.cert.org/vuls/id/518910 kb.cert.org
RSS Hunter RSS Hunter • Apr 22

VU#890999: Radware Alteon has a reflected XSS vulnerability that can execute JavaScript in the host browser

Radware Alteon has a reflected Cross-Site Scripting vulnerability in version 34.5.4.0. This flaw exists in the ReturnTo parameter of the /protected/login route. The vulnerability stems from a failure to properly sanitize user input. Attackers can exploit this by injecting malicious JavaScript into the ReturnTo parameter. When a user is redirected to a SAML login page, the load balancer reflects the unsanitized parameter. This reflected payload then executes in the victim's browser. The exploit allows attackers to steal sensitive data, perform unauthorized actions, and conduct phishing attacks. It can also damage the reputation of the affected website. Radware has acknowledged the vulnerability and plans a fix in version 34.5.7.0. Users should validate and encode input until a patch is applied.
https://kb.cert.org/vuls/id/890999 kb.cert.org
RSS Hunter RSS Hunter • Apr 21

VU#414811: Terrarium contains a vulnerability that allows arbitrary code execution

Terrarium is a platform designed for secure code execution in a sandbox environment. A critical vulnerability has been found within Terrarium, enabling arbitrary code execution with root privileges on the host Node.js process. This exploit stems from an issue within the Pyodide WebAssembly environment.The vulnerability originates from the way jsglobals objects are configured, specifically the mock document object. This object, created from a standard JavaScript object literal, inherits from Object.prototype. This inheritance allows sandboxed code to ascend the prototype chain to the function constructor. From there, attackers can create a function that returns globalThis, granting access to essential Node.js internals like require(). Consequently, an attacker can break out of the sandbox and run any command as root within the container.This sandbox escape vulnerability, identified as CVE-2026-5752, poses significant risks to applications relying on Terrarium. It allows attackers to execute commands as root, access and alter sensitive files, compromise internal network services, and potentially escape the container for further privilege escalation. Unfortunately, a vendor patch is currently unavailable.To mitigate this risk, disabling code submission to the sandbox, if feasible, is recommended. Network segmentation and the use of a Web Application Firewall (WAF) are also crucial to limit the attack surface and detect malicious traffic. Continuous monitoring of container activity for unusual behavior is advised. Furthermore, strict access controls and the use of secure container orchestration tools are essential. Keeping all dependencies updated and patched is a fundamental security practice. This vulnerability was discovered by Jeremy Brown using AI-assisted research.
https://kb.cert.org/vuls/id/414811 kb.cert.org
RSS Hunter RSS Hunter • Apr 21

VU#915947: SGLang is vulnerable to remote code execution when rendering chat templates from a model file

A remote code execution vulnerability, CVE-2026-5760, has been found in the SGLang project's reranking endpoint. Attackers can exploit this by creating a malicious model with a specially crafted tokenizer.chat_template parameter. This parameter contains a Jinja2 server-side template injection payload. When SGLang loads this model and the reranking endpoint is accessed, the malicious template renders. This triggers the execution of arbitrary Python code on the server. The vulnerability stems from the use of jinja2.Environment() without proper sandboxing. Successful exploitation allows attackers to execute code as the SGLang service. This could lead to host compromise, data theft, or denial-of-service. Deployments exposing the endpoint to untrusted networks are most at risk. The recommended solution involves using ImmutableSandboxedEnvironment for rendering chat templates instead of the vulnerable jinja2.Environment(). Project maintainers did not respond to coordination efforts for a patch.
https://kb.cert.org/vuls/id/915947 kb.cert.org
RSS Hunter RSS Hunter • Apr 20

VU#536588: Multiple Heap Buffer Overflows in Orthanc DICOM Server

Orthanc DICOM Server versions 1.12.10 and earlier have several vulnerabilities impacting image decoding and HTTP request handling. These flaws include heap buffer overflows, out-of-bounds reads, and memory exhaustion problems, exploitable through crafted inputs. Attackers can leverage these vulnerabilities to crash the server, leak sensitive data, or potentially achieve remote code execution. The vulnerabilities stem from unsafe arithmetic operations, the lack of crucial bounds checks, and insufficient validation of metadata. These issues exist within the processing of both DICOM files and HTTP requests. Identified vulnerabilities involve parsing meta-headers, handling gzip compression, and processing ZIP archives which could lead to resource exhaustion. Out-of-bounds reads are present in image decoding functions used for the proprietary Philips compression format and palette color images. Heap buffer overflows occur in the image decoder, as well as the PAM image parsing logic. Orthanc has released version 1.12.11 to fix the vulnerabilities. Users should upgrade immediately and limit exposure of upload/processing features. These vulnerabilities were discovered by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG.
https://kb.cert.org/vuls/id/536588 kb.cert.org
RSS Hunter RSS Hunter • Apr 9

VU#951662: MuPDF by Artifex contains integer overflow vulnerability.

MuPDF versions up to 1.27.0 are vulnerable to an integer overflow, identified as CVE-2026-3308. This vulnerability resides within the pdf_load_image_imp function, which handles image data processing in PDF files. An attacker can craft a malicious PDF to trigger the overflow by providing specially crafted image parameters. This overflow leads to incorrect memory allocation, specifically when calculating the image's buffer size. Consequently, the fz_unpack_stream function writes beyond the buffer's bounds during image decoding. This heap out-of-bounds write can result in application crashes or, potentially, arbitrary code execution. Any system automatically processing or rendering untrusted PDFs using MuPDF may be affected. Due to the vendor's unavailability, no official patch is currently available. Users should avoid processing untrusted PDF files where possible. Isolating PDF rendering in a sandboxed process is recommended as a mitigation. A pull request that includes the fix is available. This vulnerability was reported by Yarden Porat from Cyata.
https://kb.cert.org/vuls/id/951662 kb.cert.org
RSS Hunter RSS Hunter • Apr 2

VU#655822: Kyverno is vulnerable to server-side request forgery (SSRF)

Kyverno, a Kubernetes policy engine, has an SSRF vulnerability in versions 1.16.0 and later. This vulnerability stems from inadequate URL validation within its CEL-based HTTP functions (Get and Post). Namespaced policies can trigger arbitrary internal HTTP requests due to the lack of namespace scoping in these functions. An attacker with namespace-level permissions can exploit this flaw. They can create a malicious policy to send internal requests and exfiltrate responses. The Kyverno admission controller, which executes these requests, has privileged network access. This vulnerability could lead to cross-namespace data access and the exposure of sensitive information. A patch is unavailable, so mitigation strategies are necessary. These include strict URL validation, destination controls, and blocklists. Recommended safeguards involve blocking access to sensitive address ranges and limiting outbound requests. Applying default deny network policies to the Kyverno pod is also suggested. This vulnerability was responsibly disclosed by Igor Stepansky from Orca Security Research Pod.
https://kb.cert.org/vuls/id/655822 kb.cert.org
RSS Hunter RSS Hunter • Mar 30

VU#221883: CrewAI contains multiple vulnerabilities including SSRF, RCE and local file read

CrewAI, a tool for building multi-agent AI systems, suffers from four critical vulnerabilities. These vulnerabilities include remote code execution (RCE), arbitrary local file read, and server-side request forgery (SSRF). CVE-2026-2275, specifically, exploits the Code Interpreter Tool within CrewAI. The other vulnerabilities arise from insecure default configurations in the main agent and associated Docker images. An attacker can exploit these issues through prompt injection if they can interact with a CrewAI agent utilizing the Code Interpreter Tool. These vulnerabilities can be chained together for a greater impact. CVE-2026-2275 involves fallback to SandboxPython, leading to code execution via arbitrary C function calls. Improperly validated URLs in RAG search tools within CrewAI lead to a server-side request forgery (SSRF) vulnerability. CrewAI's failure to verify Docker's runtime status also contributes to RCE via sandbox fallbacks. An arbitrary local file read vulnerability exists within the JSON loader tool due to a lack of path validation. Exploitation allows for credential theft or further device compromise. The vendor has addressed some vulnerabilities but a complete patch is not available yet.
https://kb.cert.org/vuls/id/221883 kb.cert.org
RSS Hunter RSS Hunter • Mar 30

VU#330121: IDrive for Windows contains local privilege escalation vulnerability

The IDrive Cloud Backup Client for Windows versions 7.0.0.63 and earlier has a critical security flaw. This vulnerability allows for privilege escalation, granting unauthorized users SYSTEM-level access. The IDrive client, used for cloud backups, runs with elevated privileges on Windows systems. A flaw exists in how the client service, id_service.exe, handles specific configuration files. Standard users can modify these files due to weak permission configurations. An attacker can inject malicious code by overwriting these configuration files. When id_service.exe reads the modified files, the attacker's code executes with SYSTEM permissions. This could lead to complete control over the compromised machine. IDrive is developing a patch to address this vulnerability and users should update once it's available. In the interim, users should implement security measures to mitigate the risk. The vulnerability was discovered and reported by Matthew Owens and FRSecure.
https://kb.cert.org/vuls/id/330121 kb.cert.org
RSS Hunter RSS Hunter • Mar 24

VU#577436: Hard coded credentials vulnerability in GoHarbor's Harbor

GoHarbor's Harbor, an open-source container registry, uses a default admin password risking security. The default credentials are "admin" and "Harbor12345," set in the harbor.yml configuration. Harbor doesn't mandate password changes upon initial setup or login, thus leaving the system vulnerable. An attacker with the known default password gains full administrative control, which puts the registry at risk. Such control allows overwriting images, initiating supply-chain attacks, and potentially enabling remote code execution. Attackers can establish persistent access and disable security features to accomplish their goals. Sensitive images can be stolen or destructive actions like data deletion can occur, leading to service disruption. To mitigate risk, operators must change the default password immediately after deployment. This can be done via the interface or by setting the harbor_admin_password during installation. A fix is proposed, removing or randomizing default credentials to enhance security:
https://kb.cert.org/vuls/id/577436 kb.cert.org
RSS Hunter RSS Hunter • Mar 24

VU#624941: LibreChat RAG API contains a log-injection vulnerability

LibreChat RAG API version 0.7.0 suffers from a log-injection vulnerability due to inadequate input sanitization. This allows authenticated attackers to manipulate log entries by injecting CRLF characters. Attackers exploit this flaw by inserting malicious data into the file_id parameter of POST requests. This can lead to the forging of logs, compromising audit trail integrity and potentially obscuring malicious activity. The vulnerability could facilitate attacks like XSS or remote command execution if insecure log-management tools are used. The impact includes hindering forensic investigations and enabling user impersonation. Unfortunately, the vendor has not been reached for a patch. Mitigations involve sanitizing input, disabling the pgvector extension if not used, and validating output. These measures aim to provide layered protection against the vulnerability's exploitation. The recommended solutions cannot fully eliminate the risk and require a full patch from the vendor. The vulnerability disclosure was coordinated by Caio Bittencourt, and the document was written by Dr. Elke Drennan.
https://kb.cert.org/vuls/id/624941 kb.cert.org
RSS Hunter RSS Hunter • Mar 16

VU#907705: Graphql-upload-minimal has a prototype pollution vulnerability.

The graphql-upload-minimal package, version 1.6.1, contains a prototype pollution vulnerability. This vulnerability resides within the processRequest() function, which is responsible for handling file uploads. The package parses multipart/form-data requests to integrate uploaded files into GraphQL operations. The vulnerability arises because user-supplied paths for mapping files are not properly validated. Special JavaScript property names, including __proto__, can be used to traverse the prototype chain. This traversal allows attackers to modify the global Object.prototype. Altering Object.prototype affects all objects inheriting from it within the Node.js process. The consequences of this pollution can include logic corruption, denial of service, or privilege escalation. To mitigate this issue, users must upgrade to graphql-upload-minimal version 1.6.3 or a later release. The patched version implements checks to prevent the assignment of unsafe properties through the prototype chain.
https://kb.cert.org/vuls/id/907705 kb.cert.org
RSS Hunter RSS Hunter • Mar 12

VU#665416: SGLang (sglang) is vulnerable to code execution attacks via unsafe pickle deserialization

SGLang, a serving framework for LLMs and multimodal models, has critical pickle deserialization vulnerabilities. Two vulnerabilities, CVE-2026-3059 and CVE-2026-3060, reside in the multimodal generation and encoder parallel disaggregation modules respectively. These flaws allow attackers to execute arbitrary code by sending malicious pickle files to the ZMQ broker. CVE-2026-3989 affects the replay_request_dump.py script, enabling code execution when handling malicious pickle files. The root cause across the vulnerabilities is the use of pickle.loads() to deserialize untrusted data without proper validation. This insecure deserialization can lead to remote code execution due to pickle's execution capabilities. Attackers could gain control of the SGLang service, potentially leading to system compromise. Users should restrict network access to SGLang interfaces to mitigate these risks. The use of alternatives to pickle, like JSON or msgpack, is strongly advised to prevent similar vulnerabilities. This document serves to highlight the risks associated with improper pickle usage. A proposed patch was submitted with no observed response from the maintainers during publication.
https://kb.cert.org/vuls/id/665416 kb.cert.org
RSS Hunter RSS Hunter • Mar 12

VU#976247: Antivirus and Endpoint Detection and Response Archive Scanning Engines may not properly scan malformed zip archives

Malformed ZIP headers enable antivirus and EDR software to produce false negatives, as some extraction software can still decompress the archive. ZIP archives hold crucial metadata like compression method and version information, which antivirus engines use for preprocessing. Attackers can modify the compression method field, preventing proper decompression and analysis of the payload. After evading antivirus systems, the payload can be recovered by a custom loader that bypasses the declared method. This technique allows attackers to conceal malicious content while still being able to retrieve it programmatically. Standard extraction tools, however, often fail with errors when encountering these manipulated archives. This vulnerability is akin to previously identified CVEs. A remote attacker can craft a ZIP archive with tampered metadata to bypass inspection by antivirus or EDR software. While many products may flag the file as corrupted, execution of malicious code still requires user interaction to extract or process the archive. A custom loader that ignores the declared compression method can recover and execute the concealed content. Antivirus and EDR vendors should avoid relying solely on declared archive metadata for content handling. Scanners should implement more aggressive detection modes to validate compression method fields against actual content and flag inconsistencies. Users are advised to contact their antivirus or EDR providers for vulnerability assessment and mitigation guidance.
https://kb.cert.org/vuls/id/976247 kb.cert.org
RSS Hunter RSS Hunter • Mar 9

VU#772695: A flawed TLS handshake implementation affects Viber Proxy in multiple platforms

Viber's Cloak-mode proxy, in specific Android and Windows versions, has a critical weakness. This feature, designed to conceal proxy or VPN usage, fails its primary purpose. The TLS ClientHello fingerprint used by Cloak mode is static and lacks diversity. This makes it easily detectable by Deep Packet Inspection (DPI) systems. Consequently, network-level blocking of Viber traffic becomes straightforward in restrictive environments. This flaw undermines censorship circumvention capabilities, potentially leading to denial of service. The proxy traffic is readily identifiable, not resembling normal browser TLS behavior. Users are unaware that their data's proxy protection is compromised. To mitigate this issue, users should update their Viber Windows clients to version 27.3.0.0 and Android mobile versions to 27.2.0.0g for continued support. Oleksii Gaienko, an independent security researcher, reported this vulnerability. Laurie Tyzenhaus authored this explanatory document.
https://kb.cert.org/vuls/id/772695 kb.cert.org
RSS Hunter RSS Hunter • Mar 5

VU#431821: MS-Agent does not properly sanitize commands sent to its shell tool, allowing for RCE

A command injection vulnerability exists in the MS-Agent framework, allowing arbitrary command execution due to unsanitized prompt input. The MS-Agent framework uses a Shell tool for executing commands on the operating system. The vulnerability arises because the software fails to adequately sanitize external content before execution through this Shell tool.An attacker can use prompt injection techniques to trick the agent into running unintended shell commands. The Shell tool attempts to restrict unsafe commands using a regular expression-based denylist in its check_safe() method. However, this denylist mechanism can be bypassed by crafted input, enabling malicious commands to reach the shell execution layer. This vulnerability, tracked as CVE-2026-2256, allows attackers to execute arbitrary operating system commands. It can be exploited when the agent processes or retrieves attacker-controlled content containing malicious command sequences.Denylist-based filtering is inherently weak and can often be circumvented through various methods like encoding or obfuscation. Successful exploitation grants the attacker the ability to execute commands with the privileges of the MS-Agent process. This could lead to system file modification, lateral movement, persistence, or data exfiltration.No vendor patch or statement was provided during coordination. Users are advised to deploy MS-Agent only in trusted environments with validated input. Agents with shell execution should be sandboxed or run with least-privilege permissions. Replacing denylists with strict allowlists and improving isolation for tool execution are also recommended mitigation strategies.
https://kb.cert.org/vuls/id/431821 kb.cert.org
RSS Hunter RSS Hunter • Mar 2

VU#504749: PyMuPDF path traversal and arbitrary file write vulnerabilities

PyMuPDF version 1.26.5 contains a critical path traversal vulnerability. This vulnerability allows arbitrary file writing via the 'embedded_get' function in main.py. The flaw arises from unchecked handling of embedded file metadata within PDF documents. Specifically, this metadata is used directly as the output path for extracted files. When the output path isn't explicitly defined, PyMuPDF uses embedded file metadata. This lack of validation permits attackers to specify arbitrary file paths. Exploitation involves crafting a malicious PDF with a path leading outside the intended directory. Successful exploitation enables attackers to write files to any location accessible by the user. This write access could potentially lead to privilege escalation or system compromise. The vulnerability is addressed in PyMuPDF version 1.26.7. Users are strongly advised to update to mitigate the risk. The vulnerability was reported by UKO, and the document was written by Michael Bragg.
https://kb.cert.org/vuls/id/504749 kb.cert.org
RSS Hunter RSS Hunter • Feb 12

VU#458422: CASL Ability contains a prototype pollution vulnerability

A prototype pollution vulnerability exists in CASL Ability versions 2.4.0 through 6.7.4, specifically within the extra module's rulesToFields() function. This vulnerability stems from the setByPath() function's failure to sanitize property names. This flaw enables attackers to inject properties into object prototypes due to a lack of proper sanitization. Attackers can leverage the vulnerability to add or modify properties on an object's prototype. Consequently, attackers can manipulate the prototype chain, potentially writing to Object.prototype. This can enable arbitrary code execution within the Node.js process. The impact includes bypassing authorization, gaining unauthorized access, and manipulating application logic. Moreover, it can lead to application crashes and denial-of-service conditions. The vulnerability is especially dangerous due to the widespread use of the CASL library, posing a risk to multiple systems. The recommended solution is to upgrade to CASL Ability version 6.7.5 or later. This vulnerability was coordinated by Maor Caplan from Alma Security.
https://kb.cert.org/vuls/id/458422 kb.cert.org
RSS Hunter RSS Hunter • Feb 10

VU#481830: libheif Uncompressed Codec Lacks Bounds Check Leading to Application Crash

A vulnerability exists in libheif's uncompressed decoder due to an out-of-bounds memory access issue. This flaw allows a maliciously crafted HEIF image to trigger a denial-of-service condition. The vulnerability arises from inadequate validation of metadata values during processing. Specifically, the decoder fails to properly check values from internal metadata boxes. This can lead to the decoder reading past the end of the input buffer. This can result in a segmentation fault during image decoding. The vulnerability, identified as CVE-2025-65586, affects versions v1.19.0 through 1.21.1 of libheif, introduced in commit 6190b58f. The impact is limited to denial-of-service, causing applications using libheif to crash. The vulnerability was discovered through fuzzing with AddressSanitizer. The solution is to update to libheif version 1.21.0 or later, which includes the fix. The vulnerability was reported by Maor Caplan and fixed by Dirk Farin.
https://kb.cert.org/vuls/id/481830 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#102648: Code Injection Vulnerability in binary-parser library

The binary-parser library for Node.js suffered from a code injection vulnerability. This vulnerability affected versions before 2.3.0 and could lead to arbitrary JavaScript execution. The library allowed for dynamic JavaScript code generation using the Function constructor. User-provided data, particularly field names and encoding parameters, were incorporated without proper sanitization. This lack of sanitization permitted attackers to inject malicious code through crafted inputs. Applications utilizing untrusted data in parser definitions were vulnerable to exploitation. Successful exploitation could grant attackers control over the Node.js process. The vendor addressed the issue by releasing version 2.3.0 with input validation. Users should upgrade to the patched version to mitigate the risk. Developers should avoid including untrusted data in parser definitions to prevent similar vulnerabilities. This vulnerability was identified by Maor Caplan and fixed by Keichi Takahashi.
https://kb.cert.org/vuls/id/102648 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#458022: Open5GS WebUI uses a hard-coded secrets including JSON Web Token signing key

Open5GS WebUI has a vulnerability due to hardcoded default secrets, including the JWT signing key. This allows attackers to forge authentication tokens and gain administrative access. The WebUI, built with Node.js and Next.js, uses environment variables, by default set to "change-me," for cryptographic operations. This default is used for issuing and validating JWTs which leads to the vulnerability. Default configurations do not warn users about the insecure default secrets, making them easily exploitable. Attackers can create valid JWTs with the known default secret, bypassing CSRF protections. This allows unauthorized access to and modification of sensitive data via /api/db/* endpoints. The impact is full access to the WebUI and its permissions, including subscriber data. A patch is available introducing independent secrets via a .env file to fix this issue. Users without the patch should manually configure strong, unique, and secret values for SECRET_KEY and JWT_SECRET_KEY. Network access to the WebUI should be restricted with authentication gateways or proxies. The vulnerability was reported by Andrew Fasano from NIST, with a patch by Vijay Sarvepalli.
https://kb.cert.org/vuls/id/458022 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#271649: Stack-based buffer overflow in libtasn1 versions v4.20.0 and earlier

GNU libtasn1, a library for ASN.1 parsing, contains a stack-based buffer overflow vulnerability. The flaw resides in the asn1_expand_octet_string function within the decoding.c file. This vulnerability is triggered by unsafe string concatenation using strcpy and strcat. The concatenation of field names without bounds checking leads to a one-byte overflow in the allocated stack buffer. This occurs when handling potentially untrusted ASN.1 input, specifically with malformed data. While the overflow is small, it still can cause subtle memory corruption. This corruption could result in unexpected behavior, especially within security-critical operations, such as cryptographic activities. An attacker could exploit this vulnerability by crafting malicious ASN.1 data. The impact may include parsing failures or unusual operations during cryptographic processes. A patch has been proposed to fix this issue, offering a solution to developers. Developers are advised to review the patch and implement mitigations.
https://kb.cert.org/vuls/id/271649 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#818729: Safetica contains a kernel driver vulnerability

A vulnerability exists in Safetica's ProcessMonitorDriver.sys kernel driver, used in its data loss prevention software. This allows unprivileged users to terminate system processes through an exposed IOCTL path. The vulnerability stems from inadequate input sanitization and user validation within the driver's interface. Successfully exploiting this flaw enables a denial-of-service attack, potentially rendering Safetica systems unusable. The attacker could repeatedly terminate processes, disrupting system functionality and security monitoring. At the time of this publication, no official fix from the vendor has been released to address this critical issue. Organizations are advised to actively monitor for suspicious IOCTL calls targeting the driver. Implementing kernel driver monitoring solutions is essential for detecting abuse and unusual patterns. Restricting access to the vulnerable driver through Windows policies is also crucial. This can be achieved through Group Policies or Application Control to prevent unauthorized interactions. The report recommends blocking untrusted or unsigned binaries from communicating with the driver.
https://kb.cert.org/vuls/id/818729 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#244846: Server-Side Template Injection (SSTI) vulnerability exist in Genshi

The Genshi template engine suffers from a Server-Side Template Injection (SSTI) vulnerability. The vulnerability stems from unsafe evaluation of template expressions using Python's eval() and exec() functions. Genshi allows fallback access to Python's built-in objects during expression evaluation. An attacker can leverage this behavior to execute arbitrary code on the server. The attacker gains control by influencing or injecting malicious template expressions. This control can lead to remote code execution (RCE) with the application's privileges. The impact includes operating system commands, data access, and server compromise. The provided document offers mitigation strategies such as preventing untrusted input and sandboxing templates. Currently, no official patch from Genshi exists to address the vulnerability. The report acknowledges Jangwoo Choe and Michael Bragg for their contributions.
https://kb.cert.org/vuls/id/244846 kb.cert.org
RSS Hunter RSS Hunter • Jan 20

VU#924114: dr_flac contains an integer overflow vulnerability that allows for DoS when provided a crafted file

dr_flac, an open-source FLAC decoder within the dr_libs audio toolset, suffers from an integer overflow vulnerability. This vulnerability, identified as CVE-2025-14369, can be exploited by crafting malicious FLAC files. Providing such a file to a tool utilizing dr_flac could trigger a denial-of-service condition, causing the tool to crash. The core issue lies in the lack of input validation when calculating memory allocation based on FLAC metadata. This allows for excessive memory allocation, leading to instability. An attacker can use this flaw to make the tool allocate vast amounts of memory. The issue impacts any system using an older version of dr_flac. The vulnerability was patched in commit b2197b2, which users should update to immediately. Updating dr_flac prevents exploitation of this security bug. The vulnerability could be triggered by any tool processing untrusted FLAC files. The reporter of this issue was Maor Caplan and the initial documentation was written by Christopher Cullen.
https://kb.cert.org/vuls/id/924114 kb.cert.org
RSS Hunter RSS Hunter • Jan 20