Export limit exceeded: 24501 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24501 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18724 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-14 | 7.6 High |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Stack Buffer Overflow in idbm_recinfo_config via Malicious iSCSI Target: a crafted SendTargets TargetName can inject an extra configuration line into a persisted node record and later cause a stack buffer overflow when that record is reparsed. Requirements to exploit: An attacker must control an iSCSI target or tamper with SendTargets discovery traffic, return a crafted `TargetName` containing a newline and oversized injected key or value data, have the victim run persistent discovery, and then trigger a later node-record read such as update or login. Component affected: `iscsi-initiator-utils`; `usr/idbm.c:idbm_recinfo_config`, with attacker-controlled input reaching it through SendTargets handling in `usr/discovery.c` and later record serialization in `usr/idbm.c`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - 7.5 (HIGH) AV:N - The attacker can supply the malicious data over the network in a SendTargets discovery response. AC:L - The target-name length cap still leaves enough room for a newline plus an overlong injected key; no race or unusual memory state is required. PR:N - No prior access to the initiator is required. UI:R - The victim must run SendTargets discovery that persists records and later read the saved record. S:U - The impact remains within the initiator-side component that parses and stores its own database records. C:L - Memory corruption could expose limited process memory, but confidentiality impact is not demonstrated. I:L - Process memory corruption can affect integrity, but reliable code execution is not established. A:H - The clearest supported outcome is a crash during config parsing. Impact: Moderate. This issue could otherwise resemble an Important remote denial-of-service flaw, but Red Hat rates such issues lower when they are less easily exploited or depend on narrower conditions. Here, exploitation requires a multi-step SendTargets discovery workflow, persistence of the discovered record, and a later reread of that record. The strongest supported outcome is denial of service or other memory corruption, while code execution remains unproven. Embargo: no Reason: The available evidence supports a multi-step, configuration-dependent denial-of-service or memory-corruption issue rather than a demonstrated remote code execution flaw, so embargoed handling does not appear necessary. Acknowledgement: Aisle Research Vulnerability Details: `idbm_recinfo_config()` copies config keys and values into fixed stack buffers without bounds checks: ```c while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } ... while (*nl) { *(value+i) = *nl; i+; nl+; } ``` In this code path, `name` and `value` are 128-byte and 256-byte stack buffers, so an injected key longer than 128 bytes or a value longer than 256 bytes can corrupt stack memory. During SendTargets discovery, attacker-controlled `TargetName` text is copied into the node record and later written back to disk without control-character filtering: ```c strlcpy(rec->name, targetname, TARGET_NAME_MAXLEN); ... if (strlen(info[i].value)) fprintf(f, "%s = %s\n", info[i].name, info[i].value); ``` `process_sendtargets_response()` treats `TargetName=` records as discovery input, and `add_target_record()` accepts names up to `TARGET_NAME_MAXLEN`. That limit is 255 bytes in this package, which is still enough to carry a newline plus a key longer than the 128-byte `name` buffer. A `TargetName` such as `iqn.test\nAAAA...=B` can therefore split the serialized `node.name` entry into two lines and inject a second config line. Persistent SendTargets discovery stores discovered node records unless nonpersistent mode is used, and later discovery update/login or explicit node operations reread those saved records. The 2048-byte line buffer in `idbm_recinfo_config()` does not prevent this because the injected line only needs to exceed 128 bytes for the key or 256 bytes for the value. Based on the available evidence, the supported impact is a crash or other memory corruption during reparsing. Reliable code execution is plausible but not established. Steps to reproduce: 1. Run a malicious SendTargets responder, or intercept discovery traffic, and return a `TargetName` value containing a newline and an oversized injected key, for example `TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B`. 2. Run SendTargets discovery in its normal persistent mode. The default `iscsiadm -m discovery ...` workflow persists records unless nonpersistent mode is selected. 3. Inspect the saved node record and confirm that it contains both the expected `node.name = ...` line and an injected `AAAA...=B` line. 4. Trigger any operation that rereads the node record, such as discovery update, node update, or login. 5. Observe a crash during parsing. With instrumentation enabled, the overflow should be reported in `idbm_recinfo_config()`. Mitigation: Until a fix is available, avoid persistent SendTargets discovery against untrusted or interceptable networks. Where operationally acceptable, use nonpersistent discovery, and remove node records created from untrusted discovery results before later update or login operations. Proposed Fix: The fix should address both parts of the chain: bound the key and value copies in `idbm_recinfo_config()` and reject control characters in `TargetName` before persistence. ```diff diff --git a/usr/idbm.c b/usr/idbm.c @@ void idbm_recinfo_config(recinfo_t *info, FILE *f) while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } + while (*nl && !isspace(c = *nl) && *nl != '=') { + if (i >= NAME_MAXVAL - 1) { + log_warning("Config file line %d key too long", line_number); + break; + } + name[i++] = *nl++; + } @@ while (*nl) { *(value+i) = *nl; i+; nl+; } + while (*nl) { + if (i >= VALUE_MAXVAL - 1) { + log_warning("Config file line %d value too long", line_number); + break; + } + value[i++] = *nl++; + } diff --git a/usr/discovery.c b/usr/discovery.c @@ static int add_target_record(char *name, char *end, discovery_rec_t *drec, while ((nul < end) && (*nul != '\0')) nul++; + for (char *p = name; p < nul; p++) { + if (*p == '\n' || *p == '\r' || (unsigned char)*p < 0x20) { + log_error("TargetName contains control characters, rejecting"); + return 0; + } + } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-19815 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-19792 | 1 Tenda | 1 G0 | 2026-08-14 | 8.8 High |
| A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-19821 | 1 Tenda | 1 Ac12 | 2026-08-14 | 8.8 High |
| A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-66810 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-08-14 | 5.5 Medium |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-68793 | 1 Microsoft | 12 365, 365 Apps, Excel and 9 more | 2026-08-14 | 7.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-53792 | 1 Rsync Project | 1 Rsync | 2026-08-14 | 6.5 Medium |
| rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side. | ||||
| CVE-2026-53794 | 1 Rsync Project | 1 Rsync | 2026-08-14 | 5.3 Medium |
| rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service. | ||||
| CVE-2026-55402 | 1 Absolute | 1 Secure Access | 2026-08-14 | N/A |
| CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service. | ||||
| CVE-2026-19813 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Such manipulation of the argument Comment leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-19814 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-65933 | 1 Silabs.com | 1 Bt122 | 2026-08-14 | N/A |
| A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. | ||||
| CVE-2026-65936 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | N/A |
| A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. | ||||
| CVE-2026-19812 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-19811 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-68082 | 1 Linux | 1 Linux Kernel | 2026-08-14 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_32(p) at the num_lockers field has no preceding bounds check. ceph_start_decoding() accepts struct_len=0 as valid -- the internal ceph_decode_need(p, end, 0, bad) always passes -- so when an OSD sends struct_len=0, ceph_start_decoding() returns success with p == end. The immediately following bare ceph_decode_32(p) then reads 4 bytes past the validated buffer boundary. The garbage value is passed directly to kzalloc_objs() as the locker count. The sibling function decode_watchers() in osd_client.c already uses ceph_decode_32_safe() after its own ceph_start_decoding() call. decode_lockers() was the only site using the bare variant. 2. ceph_decode_8(p) after the decode_locker() loop has no preceding bounds check. If an OSD crafts num_lockers such that the loop advances p exactly to end, the subsequent bare ceph_decode_8(p) reads one byte past the validated buffer boundary. The result is passed directly into *type, which is used as a lock type discriminator by callers, giving an OSD-controlled one-byte OOB read with direct influence over the lock type field. Fix both by replacing bare operations with their safe variants: ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers, err_inval) ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type, err_free_lockers) The goto targets differ intentionally: err_inval: is a new label returning -EINVAL directly. It is used for the pre-allocation failure path where *lockers is not yet allocated and must not be passed to ceph_free_lockers(). err_free_lockers: is the existing label. It is used for the post-allocation failure path where *lockers is allocated and must be freed. ret is set to -EINVAL before ceph_decode_8_safe() so that err_free_lockers returns the correct error code on bounds violation. Without this, err_free_lockers would return a stale ret value (0 from the successful decode_locker() loop), silently swallowing the error. -EINVAL is correct for both failure paths. The data received from the OSD is structurally malformed. -ENOMEM would misrepresent the failure class to callers and to stable@ backporters triaging error paths. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition). [ idryomov: trim changelog, formatting ] | ||||
| CVE-2026-19788 | 1 Tenda | 2 Ac1206, Ac1206 Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-19789 | 1 Tenda | 2 Ac1206, Ac1206 Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-40981 | 2 Spring, Vmware | 2 Spring Cloud Config, Spring Cloud Config | 2026-08-14 | 7.5 High |
| When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater. | ||||
| CVE-2026-19791 | 1 Tenda | 1 G0 | 2026-08-14 | 8.8 High |
| A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. | ||||