Vladimir Tokarev

An input validation issue exists where processing web content may disclose sensitive information.

SM2 signature generation uses non-constant-time arithmetic on secret values, creating a timing side-channel. The process computes the signature value using variable-time BIGNUM operations on the private key and the secret nonce, meaning the time required to produce a signature depends on these secret values. An attacker capable of measuring signing times may obtain information about the per-signature secret nonce, which could lead to the recovery of the private key through a lattice or Hidden Number Problem attack.

An improper authentication issue in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints rely on client-supplied node information for authentication without sufficiently verifying the requesting party. In specific network configurations, this allows an attacker to bypass access controls and access internal FE metadata interfaces, which may expose sensitive cluster information.

A time-of-check/time-of-use (TOCTOU) race condition exists in OpenShell sandbox filesystem writes. This flaw allows attackers to use symlink swaps during filesystem operations to bypass sandbox restrictions and redirect writes outside the intended local mount root.

A time-of-check/time-of-use (TOCTOU) race condition exists in the OpenShell filesystem bridge. This issue allows attackers to use symlink swaps during filesystem operations to bypass sandbox restrictions, enabling the reading of files outside the intended mount root and access to unauthorized file contents.

OpenClaw derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can bypass owner-gated operations by manipulating the `sender-owner` header metadata or the `senderIsOwner` flag, allowing them to present themselves as the owner and gain full owner control.

An exec allowlist analysis issue allows shell expansion to be hidden within unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies, enabling the execution of unapproved commands at runtime. This can lead to the leakage of API keys through paths that appear safe during validation. Approximately 245,000 instances are potentially exposed.

The issue is related to the interactive service in OpenVPN, which allows an attacker to send data causing a stack overflow. This can be used to execute arbitrary code with more privileges. The vulnerability is also described as being related to insufficient restriction of the communication channel for given endpoints, which can allow a remote attacker to elevate their privileges and execute arbitrary code.

The issue is related to the interactive service in OpenVPN, which allows the OpenVPN service pipe to be accessed remotely. This enables a remote attacker to interact with the privileged OpenVPN interactive service, potentially leading to privilege escalation and arbitrary code execution. The vulnerability is associated with insufficient restriction of the communication channel for specified endpoints.

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.9 and earlier Description: The issue is related to the unrestricted loading of plug-in files in OpenVPN on Windows. This allows an attacker to load an arbitrary plug-in, which can interact with the privileged OpenVPN interactive service. Recommendations: For OpenVPN versions 2.6.9 and earlier, consider disabling the plug-in loading feature until a patch is available. Restrict access to the OpenVPN interactive service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the tap-windows6 driver not properly checking the size data of incoming write operations, which can be used by an attacker to overflow memory buffers. This can result in a bug check and potentially allow for arbitrary code execution in kernel space. The vulnerability is associated with an integer overflow.

The issue is caused by an integer overflow in the cloud-brd binary, leading to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CmpAppForce component of Codesys products. After successful user authentication, an attacker can send crafted network communication requests with inconsistent content, causing the component to read from an invalid internal address. This can potentially lead to a denial-of-service condition. The vulnerability can be exploited by a remote attacker.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CmpAppForce component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. Specifically, after successful user authentication, crafted network communication requests with inconsistent content can lead to the CmpAppForce component reading from an invalid internal address.

The issue is related to a buffer overflow in the memory of the CMPappBP component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. The exploitation requires successful authentication as a user in the affected CODESYS products. Specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, leading to the denial-of-service condition.

The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service.