Shadowbyte1

An out-of-bounds write exists in the HTTP/2 front-end of the Zephyr HTTP server when serving static files. The issue occurs in the `handle http2 static fs resource()` function within `subsys/net/lib/http/http server http2.c`, where the `&client->data len` variable is incorrectly used as the `file size` out-parameter for `http server find file()`. This causes the receive buffer length to be replaced by the actual size of the file on disk. An unauthenticated attacker can trigger this by sending an HTTP/2 GET request for any file under the web root in applications where `CONFIG FILE SYSTEM=y` and `CONFIG HTTP SERVER VERSION 2` is enabled. This leads to several memory safety issues: - Out-of-bounds reads in `parse http frame header()` and per-frame handlers. - A buffer overflow during a `memmove()` operation that overwrites the `http client ctx` structure, including function-pointer tables and timers. - An out-of-bounds write via `zsock recv()` due to a size argument underflow. This remote memory corruption can result in a device crash, hang, or potential arbitrary code execution.

The `DecodeWinevt` function in `src/analysisd/decoders/winevtchannel.c` accumulates unnamed Windows EventChannel Data element contents into a fixed 65,535-byte `join data` heap buffer. The issue occurs because the function passes the growing content length as the `snprintf` size instead of the `OS MAXSTR` buffer capacity. An enrolled agent can trigger this by submitting an EventChannel message containing four maximum-sized unnamed Data elements, which leads to a write beyond the `join data` buffer and corrupts adjacent heap metadata. This results in the termination of the `wazuh-analysisd` process when `join data2` is freed, effectively stopping log ingestion for all agents managed by that instance.

A memory corruption issue exists in the `FinalizationRegistry::cleanup()` function within Libraries/LibJS/Runtime/FinalizationRegistry.cpp. The process occurs when a dead record is removed from `m records` while an iterator to the next FinalizationRecord is retained. If the cleanup callback invokes attacker-controlled JavaScript that calls `unregister()` for the next record, the `remove by token()` function frees the node referenced by the iterator. Subsequent cleanup iterations then read the `target` and `held value` fields after they have been freed, leading to crashes in instrumented WebContent builds or memory corruption in production builds.

Prometheus is an open-source monitoring system and time series database. The remote read endpoint "/api/v1/read" fails to validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload to trigger a large heap allocation per request, which can exhaust available memory and crash the process under concurrent load.

A heap-use-after-free issue exists in the `PdfTokenizer::ReadDictionary` function. This allows attackers to potentially cause a Denial of Service (DoS) by providing a specially crafted PDF file.

A CRLF injection flaw exists in Neto CMS. This issue allows attackers to potentially execute arbitrary code by submitting a specially crafted HTTP request. The vulnerability is due to insufficient input validation, specifically regarding carriage return and line feed characters.

A reflected cross-site scripting (XSS) issue exists in Codazon Magento Themes. This allows attackers to execute arbitrary Javascript within a user's browser by injecting a crafted payload into the `cat` parameter. The attack is reflected, meaning the malicious script is executed when a user interacts with a specially crafted link.

The software is susceptible to a stack consumption issue leading to a SIGSEGV signal. This occurs when processing PDF documents containing deeply nested structures within their metadata, such as the `GTS PDFEVersion` field. The issue is present in functions including `Dict::lookup`, `Catalog::getMetadata`, and related functions within `PDFDoc`, specifically due to deep recursion in the regular expression executor (`std:: detail:: Executor`).

The issue concerns a SQL injection vulnerability. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include `Booking ID`, `Action Name`, and `Payment Confirmation ID`, which are present in "/newvehicle.php" and "/newdriver.php".

The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an authenticated arbitrary file upload vulnerability.

The issue is a Stored Cross-Site Scripting (XSS) vulnerability in the `Name` parameter of the "/vehicle-management/booking.php" API endpoint. This allows for malicious scripts to be stored and executed on the system.