Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A heap out-of-bounds read vulnerability exists in NanaZip versions 1.0.88.0 through 6.0.1698.0 (stable) and 6.5.1742.0 (preview). The flaw resides in the Lz4Decode function within SquashfsHandler.cpp, where negative error values returned by LZ4_decompress_safe are not properly handled. The negative integer is incorrectly converted to an unsigned SizeT, causing ReadBlock to trust an attacker-inflated cached unpack block size. During SquashFS fragment extraction, an attacker-controlled inode offset can trigger a memcpy that reads beyond the allocated heap buffer, potentially leaking adjacent heap memory contents into the extracted file or crashing the process. This represents a significant information disclosure and denial-of-service risk when processing maliciously crafted SquashFS archives. The vulnerability is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0. Users are strongly advised to update to the patched releases immediately.
Bekijk origineel advisory →WeGIA versions before 3.9.2 contain a critical authorization bypass vulnerability in the password change workflow. Any authenticated user can change their account password without providing existing credentials. The flaw stems from the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers manipulate the redir parameter to redirect to alterar_senha.php, routing through verificarSenhaConfig() instead of the expected verificarSenha() function. This effectively bypasses current password verification entirely. The vulnerability enables attackers to convert temporary session access into permanent account takeover. A fix was released in WeGIA version 3.9.2.
Bekijk origineel advisory →A critical off-by-one stack buffer overflow vulnerability exists in libevent versions prior to 2.1.13 and 2.2.2-alpha. The flaw resides in evdns.c within the dnsname_to_labels function, which incorrectly permits a terminating null byte to be written one position beyond the end of a 64 KB stack buffer. The vulnerability can be triggered by a crafted DNS server response containing PTR, CNAME, MX, NS, or SOA record types. Successful exploitation can lead to process crash or memory corruption. The root cause is a faulty boundary check in the final-label validation logic inside evdns_server_request_format_response. The issue affects any application or system relying on libevent for DNS resolution. Fixes are available in libevent versions 2.1.13-stable and 2.2.2-alpha. Users are strongly advised to upgrade to patched versions immediately.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the /admin/ajax.php?action=delete_category file, where manipulation of the 'ID' argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability was reported via VulDB and GitHub, and is tracked as CVE-2026-76998. Attackers could potentially use this to manipulate or extract database contents. The issue affects the admin panel's category deletion functionality. No patch or mitigation details are mentioned in the article.
Bekijk origineel advisory →CVE-2026-69555 describes an incorrect authorization vulnerability in Microsoft Azure Arc. The flaw allows an unauthorized attacker to elevate privileges over a network without proper authentication. This type of vulnerability is classified as a privilege escalation issue, which can have significant security implications in cloud-connected environments. Azure Arc is a Microsoft service that extends Azure management capabilities to on-premises, multi-cloud, and edge environments. The vulnerability has been assigned a high criticality rating. Details have been published on the NVD (National Vulnerability Database) and the Microsoft Security Response Center (MSRC). At the time of publication, the status is listed as 'Received', indicating it is in early stages of NVD processing.
Bekijk origineel advisory →A critical use-after-free vulnerability has been identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems. Use-after-free vulnerabilities occur when a program continues to use memory after it has been freed, potentially allowing attackers to manipulate program execution. The flaw poses a significant risk to enterprise environments running IBM AIX or PowerVM VIOS infrastructure. IBM has published an advisory with remediation guidance. Organizations using affected versions should apply patches or mitigations promptly. The vulnerability is tracked as CVE-2026-17118 and has been assigned a high criticality rating.
Bekijk origineel advisory →Expat through version 2.8.3 contains an out-of-bounds read vulnerability triggered when processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes the storeAtts function to read the attIndex member past allocated memory boundaries. This can result in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference leading to a segfault. The vulnerability allows attackers to trigger memory corruption through specially crafted XML input. Notably, this vulnerability was introduced as a regression by the fix applied for CVE-2026-66046. Patches are available via a commit to the libexpat GitHub repository and referenced in pull request #1331. The issue is also documented by VulnCheck in their advisories.
Bekijk origineel advisory →A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the sprintf function within the /cgi-bin/mbox-config CGI endpoint when the method is SET and section is ptest_sn. An attacker can manipulate the 'sn' argument to inject arbitrary commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This affects network/IoT devices running the vulnerable firmware version. The issue has been assigned CVE-2026-77004 and documented on NVD and VulDB. Organizations using Comfast CF-N1-S devices should review exposure and apply mitigations promptly.
Bekijk origineel advisory →CVE-2026-17141 is a critical buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems without authentication. Buffer overflow vulnerabilities of this nature are considered high severity due to the potential for complete system compromise. IBM has published a support advisory with remediation guidance. Organizations running affected IBM AIX or PowerVM VIOS versions should prioritize patching immediately. The vulnerability impacts enterprise-grade UNIX operating system and virtualization infrastructure commonly used in large-scale enterprise and critical environments.
Bekijk origineel advisory →A critical vulnerability was identified in the multicloud-operators-subscription component affecting Kubernetes/OpenShift environments. Tenants with the ability to create HelmRelease custom resources can bypass existing security controls. The HelmRelease controller processes Helm chart templates using elevated ServiceAccount privileges without proper validation. This allows malicious tenants to deploy arbitrary resources across the entire cluster. The flaw represents a significant privilege escalation and tenant isolation bypass. It can lead to full cluster compromise by an otherwise limited tenant. The vulnerability is tracked as CVE-2026-67567 and has been reported by Red Hat. A corresponding Bugzilla report (2514224) has been filed for remediation tracking.
Bekijk origineel advisory →CVE-2026-63509 describes a relative path traversal vulnerability in Microsoft Fabric. The flaw allows an authorized attacker to elevate privileges over a network. The vulnerability requires the attacker to already have some level of authorization within the environment. Privilege escalation vulnerabilities in cloud and data platform services like Microsoft Fabric can have significant impact on enterprise environments. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. No additional technical details or proof-of-concept exploits are referenced in the current disclosure. Organizations using Microsoft Fabric should monitor for patches and apply mitigations as directed by Microsoft.
Bekijk origineel advisory →A critical vulnerability has been identified in FreeIPA affecting environments where a trust relationship exists between FreeIPA and Active Directory. Authenticated Active Directory users can bypass authentication mechanisms for FreeIPA services including the web portal, SMB server, and LDAP directory. The attack vector involves impersonating a client name within the Ticket Granting Service (TGS) due to FreeIPA's failure to verify Privilege Attribute Certificate (PAC) certificates. Successful exploitation allows privilege escalation within the FreeIPA domain. The vulnerability is tracked as CVE-2026-11861 and is currently awaiting full analysis on NVD. Red Hat has published an advisory and a corresponding Bugzilla report has been filed. Organizations using FreeIPA with Active Directory trust relationships are at elevated risk.
Bekijk origineel advisory →CVE-2026-55765 affects CloudNativePG, a platform for managing PostgreSQL databases in Kubernetes. Versions prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE SQL statements. If pg_stat_statements was preloaded with track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats privileges could recover superuser or application-owner passwords. With those credentials, the attacker could reconnect via superuser TCP access and execute OS-level commands inside the database pod using COPY ... FROM PROGRAM. Clusters using SCRAM-SHA-256 verifiers were not affected by this vulnerability. The issue has been remediated in versions 1.28.4, 1.29.2, and 1.30.0.
Bekijk origineel advisory →A HTTP request smuggling vulnerability (CL.TE desynchronization) exists in Mongoose, an embedded web server and network library, prior to version 7.22. A remote unauthenticated attacker can craft an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The mg_http_parse() and http_cb() functions in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy may interpret request boundaries differently. This mismatch allows an attacker to inject smuggled requests that can access or modify resources belonging to other users. The vulnerability requires no authentication to exploit and can lead to unauthorized data access or modification in another user's context. The issue has been patched in Mongoose version 7.22, with a fix available via the official GitHub repository.
Bekijk origineel advisory →A vulnerability in hank-ai/darknet involves unchecked 32-bit integer arithmetic when sizing convolutional layer weight and output heap buffers from .cfg configuration files. The computation of l.nweights and l.outputs can overflow when dimension products exceed INT_MAX, causing undersized memory allocations. An attacker can craft a malicious .cfg file where dimensions like width/height of 256 with 65536 filters produce a 2^32 product wrapping to zero. The forward_convolutional_layer function then re-derives GEMM dimensions with a different operand order, causing reads and writes beyond the undersized buffer. No valid .weights file is required, only the crafted .cfg file. A proof-of-concept demonstrated heap buffer overflow reads in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in release builds, confirming out-of-bounds write capability.
Bekijk origineel advisory →CVE-2026-65816 is a vulnerability in Microsoft Azure Arc involving the use of an incorrectly-resolved name or reference. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. This type of vulnerability is categorized under improper name/reference resolution, which can be exploited remotely. The affected product is Azure Arc, Microsoft's hybrid and multi-cloud management platform. The vulnerability has been assigned a high severity rating. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). No additional technical details or proof-of-concept information are currently available in the article. Organizations using Azure Arc should monitor for patches and apply mitigations as soon as they become available.
Bekijk origineel advisory →A command injection vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The vulnerability exists in the formcreateFileName function within the /goform/formcreateFileName endpoint. Attackers can manipulate the fileNameMit argument to inject arbitrary commands. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This affects Tenda CH22 routers, which are network infrastructure devices. The vulnerability is classified as high severity due to its remote exploitability and public disclosure. No patch or mitigation details are mentioned in the article.
Bekijk origineel advisory →A vulnerability in Mongoose, an embedded web server and network library, allows remote unauthenticated attackers to perform HTTP request smuggling against HTTP/1.0 reverse-proxy deployments. The flaw exists in the http_cb() function in src/http.c, where hm.proto.len is tested with an impossible greater-than-eight condition, causing is_http_1_0 to never be set. This logic error allows Mongoose to process chunked Transfer-Encoding that an HTTP/1.0 proxy would normally ignore. By sending a crafted request with conflicting framing, an attacker can exploit this discrepancy to smuggle requests. The impact includes unauthorized access and unauthorized state changes on the affected system. The vulnerability affects all versions of Mongoose prior to 7.22. A fix has been released in version 7.22 along with an associated GitHub commit and security advisory.
Bekijk origineel advisory →CVE-2026-68789 describes an SQL injection vulnerability in Microsoft Azure SQL Database. The flaw involves improper neutralization of special elements in SQL commands, allowing an authorized attacker to elevate privileges over a network. The vulnerability is classified as a privilege escalation issue exploitable remotely. It requires the attacker to already have some level of authorization before exploitation. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. Given the cloud database context, the potential impact on sensitive data and infrastructure is significant.
Bekijk origineel advisory →A Cross-Site Request Forgery (CSRF) vulnerability has been identified in HashThemes Easy Elementor Addons, a WordPress plugin. The vulnerability affects all versions of the plugin up to and including 2.3.7. Exploitation of this flaw could allow an attacker to perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious page. The issue is tracked as CVE-2026-28164 and has been documented by both the NVD and Patchstack. No patch version lower bound is specified, indicating all prior releases may be affected. WordPress site administrators using this plugin are advised to update to a patched version as soon as one becomes available. The vulnerability is classified under CWE for CSRF attacks, which can lead to privilege escalation or data manipulation depending on the plugin's functionality.
Bekijk origineel advisory →