Vladimir Tokarev

توجد مشكلة في التحقق من صحة المدخلات حيث قد يؤدي معالجة محتوى الويب إلى الكشف عن معلومات حساسة.

SM2 signature generation uses non-constant-time arithmetic on secret values, creating a timing side-channel. The process computes the signature value using variable-time BIGNUM operations on the private key and the secret nonce, meaning the time required to produce a signature depends on these secret values. An attacker capable of measuring signing times may obtain information about the per-signature secret nonce, which could lead to the recovery of the private key through a lattice or Hidden Number Problem attack.

An improper authentication issue in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints rely on client-supplied node information for authentication without sufficiently verifying the requesting party. In specific network configurations, this allows an attacker to bypass access controls and access internal FE metadata interfaces, which may expose sensitive cluster information.

توجد حالة تنافس في وقت الفحص/وقت الاستخدام (TOCTOU) في عمليات الكتابة على نظام ملفات OpenShell في بيئة الحماية. تسمح هذه الثغرة للمهاجمين باستخدام تبديل الروابط الرمزية أثناء عمليات نظام الملفات لتجاوز قيود بيئة الحماية وإعادة توجيه عمليات الكتابة خارج جذر التثبيت المحلي المقصود.

توجد حالة تنافس في وقت الفحص/وقت الاستخدام (TOCTOU) في جسر نظام الملفات OpenShell. تسمح هذه المشكلة للمهاجمين باستخدام تبديل الروابط الرمزية أثناء عمليات نظام الملفات لتجاوز قيود بيئة الحماية (sandbox)، مما يتيح قراءة الملفات خارج جذر التثبيت المقصود والوصول إلى محتويات الملفات غير المصرح بها.

يستمد OpenClaw سياق مالك MCP الخاص بـ«loopback» من رموز «bearer» الصادرة عن الخادم والقابلة للتزوير في رؤوس الطلبات. يمكن لعملاء loopback غير المالكين تجاوز العمليات المقيدة بالمالك عن طريق التلاعب ببيانات تعريف رأس `sender-owner` أو علامة `senderIsOwner`، مما يسمح لهم بالتظاهر بأنهم المالك والحصول على السيطرة الكاملة للمالك.

تسمح مشكلة في تحليل قائمة السماح بتنفيذ (exec allowlist) بإخفاء توسيع شل (shell expansion) داخل نصوص heredoc غير المحاطة بعلامات اقتباس. يمكن للمهاجمين تجاوز التحقق من قائمة السماح عن طريق تضمين رموز توسيع shell في نصوص heredoc، مما يتيح تنفيذ أوامر غير معتمدة أثناء وقت التشغيل. وقد يؤدي ذلك إلى تسرب مفاتيح واجهة برمجة التطبيقات (API) عبر مسارات تبدو آمنة أثناء عملية التحقق. ويُقدَّر عدد الحالات المعرضة للخطر بنحو 245,000 حالة.

The issue is related to the interactive service in OpenVPN, which allows an attacker to send data causing a stack overflow. This can be used to execute arbitrary code with more privileges. The vulnerability is also described as being related to insufficient restriction of the communication channel for given endpoints, which can allow a remote attacker to elevate their privileges and execute arbitrary code.

The issue is related to the interactive service in OpenVPN, which allows the OpenVPN service pipe to be accessed remotely. This enables a remote attacker to interact with the privileged OpenVPN interactive service, potentially leading to privilege escalation and arbitrary code execution. The vulnerability is associated with insufficient restriction of the communication channel for specified endpoints.

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.9 and earlier Description: The issue is related to the unrestricted loading of plug-in files in OpenVPN on Windows. This allows an attacker to load an arbitrary plug-in, which can interact with the privileged OpenVPN interactive service. Recommendations: For OpenVPN versions 2.6.9 and earlier, consider disabling the plug-in loading feature until a patch is available. Restrict access to the OpenVPN interactive service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the tap-windows6 driver not properly checking the size data of incoming write operations, which can be used by an attacker to overflow memory buffers. This can result in a bug check and potentially allow for arbitrary code execution in kernel space. The vulnerability is associated with an integer overflow.

The issue is caused by an integer overflow in the cloud-brd binary, leading to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CmpAppForce component of Codesys products. After successful user authentication, an attacker can send crafted network communication requests with inconsistent content, causing the component to read from an invalid internal address. This can potentially lead to a denial-of-service condition. The vulnerability can be exploited by a remote attacker.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CmpAppForce component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. Specifically, after successful user authentication, crafted network communication requests with inconsistent content can lead to the CmpAppForce component reading from an invalid internal address.

The issue is related to a buffer overflow in the memory of the CMPappBP component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. The exploitation requires successful authentication as a user in the affected CODESYS products. Specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, leading to the denial-of-service condition.

The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.