Vull

A weakness exists in the `kvstoreGetHashtable()` function within the `src/kvstore.c` file. Manipulation of the `didx` variable can lead to an out-of-bounds read, which occurs when the software reads data outside the intended boundary of a buffer. This issue can be triggered remotely but requires high complexity, specifically requiring cluster mode and an attacker-controlled `dump.rdb` file at startup, which could be achieved via data-dir write access, a replication feed, or a stored crafted RDB. This can result in a Denial of Service (DoS) at boot.

A remote out-of-bounds read exists in the Slot Migration component within the `createSlotImportJob()` function of the `src/cluster migrateslots.c` file. This issue occurs when the `job name` argument is manipulated.

A remote attacker can cause a use after free condition by manipulating the `EventFilter` argument within the `monitored item event filter treatment bs init event filter ctx and result()` function located in the `src/ClientServer/services/bgenc/subscription mgr.c` file. Use after free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

A double free issue exists in the Module Timer Subsystem within the `moduleTimerHandler()` function located in the `src/module.c` file. This flaw allows a remote attacker to trigger a double free, which occurs when the system attempts to free the same memory location twice, potentially leading to a crash or arbitrary code execution.

A use after free flaw exists in the Blocked-on-keys Subsystem within the `handleClientsBlockedOnKey()` function located in the src/blocked.c file. This issue can be triggered remotely, although the attack complexity is high and exploitability is considered difficult.

A remote attack can trigger a use after free condition within the History Backend component. This occurs specifically in the `UA DataValue backend copyRange()` function located in the `plugins/historydata/ua history data backend memory.c` file. Use after free is a memory corruption issue where a program continues to use a pointer after it has been freed, potentially leading to crashes or arbitrary code execution.

A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system.

A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited.

A weakness in the DeleteMonitoredItemsRequest Handler component allows for an out-of-bounds read, which occurs when the system reads data outside the intended boundary of a buffer. This issue is located within the `LockedStaMac ProcessMsg DeleteMonitoredItemsResponse()` function in the file src/ClientServer/frontend/client wrapper/internal/state machine.c. This flaw can only be exploited by a local attacker.

A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker.

A security flaw allows for a remote out-of-bounds write, which occurs when the `PDULength` argument is manipulated within the `TSnap7Peer::NegotiatePDULength()` function located in the `src/core/s7 peer.cpp` file.

A remote attack can trigger an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. This issue is located in the `CipAppPath::deserialize symbolic()` function within the source/src/cip/cipepath.cc file.

A remote issue exists in the Shared Client Library within the `responseReadNamespacesArray()` function located in the `src/client/ua client connect.c` file. Manipulation of the `Server NamespaceArray` argument can lead to a null pointer dereference, which occurs when a program attempts to read or write to a memory address that is null, typically resulting in a crash.

A flaw in the ReadVar Request Handler component allows for deserialization. The issue resides in the `TS7Worker::PerformFunctionRead()` function within the `src/core/s7 server.cpp` file. Exploitation of this issue requires the attacker to have access to the local network.