Export limit exceeded: 386272 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4076 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19823 | 1 Tenda | 2 W20e, W20e Firmware | 2026-08-14 | 8.8 High |
| A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-70346 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-14 | 7.8 High |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70344 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-14 | 7.8 High |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62824 | 1 Microsoft | 8 Windows 10 1607, Windows Server 2012, Windows Server 2012 (server Core Installation) and 5 more | 2026-08-14 | 8.8 High |
| Stack-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-18724 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-14 | 7.6 High |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Stack Buffer Overflow in idbm_recinfo_config via Malicious iSCSI Target: a crafted SendTargets TargetName can inject an extra configuration line into a persisted node record and later cause a stack buffer overflow when that record is reparsed. Requirements to exploit: An attacker must control an iSCSI target or tamper with SendTargets discovery traffic, return a crafted `TargetName` containing a newline and oversized injected key or value data, have the victim run persistent discovery, and then trigger a later node-record read such as update or login. Component affected: `iscsi-initiator-utils`; `usr/idbm.c:idbm_recinfo_config`, with attacker-controlled input reaching it through SendTargets handling in `usr/discovery.c` and later record serialization in `usr/idbm.c`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - 7.5 (HIGH) AV:N - The attacker can supply the malicious data over the network in a SendTargets discovery response. AC:L - The target-name length cap still leaves enough room for a newline plus an overlong injected key; no race or unusual memory state is required. PR:N - No prior access to the initiator is required. UI:R - The victim must run SendTargets discovery that persists records and later read the saved record. S:U - The impact remains within the initiator-side component that parses and stores its own database records. C:L - Memory corruption could expose limited process memory, but confidentiality impact is not demonstrated. I:L - Process memory corruption can affect integrity, but reliable code execution is not established. A:H - The clearest supported outcome is a crash during config parsing. Impact: Moderate. This issue could otherwise resemble an Important remote denial-of-service flaw, but Red Hat rates such issues lower when they are less easily exploited or depend on narrower conditions. Here, exploitation requires a multi-step SendTargets discovery workflow, persistence of the discovered record, and a later reread of that record. The strongest supported outcome is denial of service or other memory corruption, while code execution remains unproven. Embargo: no Reason: The available evidence supports a multi-step, configuration-dependent denial-of-service or memory-corruption issue rather than a demonstrated remote code execution flaw, so embargoed handling does not appear necessary. Acknowledgement: Aisle Research Vulnerability Details: `idbm_recinfo_config()` copies config keys and values into fixed stack buffers without bounds checks: ```c while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } ... while (*nl) { *(value+i) = *nl; i+; nl+; } ``` In this code path, `name` and `value` are 128-byte and 256-byte stack buffers, so an injected key longer than 128 bytes or a value longer than 256 bytes can corrupt stack memory. During SendTargets discovery, attacker-controlled `TargetName` text is copied into the node record and later written back to disk without control-character filtering: ```c strlcpy(rec->name, targetname, TARGET_NAME_MAXLEN); ... if (strlen(info[i].value)) fprintf(f, "%s = %s\n", info[i].name, info[i].value); ``` `process_sendtargets_response()` treats `TargetName=` records as discovery input, and `add_target_record()` accepts names up to `TARGET_NAME_MAXLEN`. That limit is 255 bytes in this package, which is still enough to carry a newline plus a key longer than the 128-byte `name` buffer. A `TargetName` such as `iqn.test\nAAAA...=B` can therefore split the serialized `node.name` entry into two lines and inject a second config line. Persistent SendTargets discovery stores discovered node records unless nonpersistent mode is used, and later discovery update/login or explicit node operations reread those saved records. The 2048-byte line buffer in `idbm_recinfo_config()` does not prevent this because the injected line only needs to exceed 128 bytes for the key or 256 bytes for the value. Based on the available evidence, the supported impact is a crash or other memory corruption during reparsing. Reliable code execution is plausible but not established. Steps to reproduce: 1. Run a malicious SendTargets responder, or intercept discovery traffic, and return a `TargetName` value containing a newline and an oversized injected key, for example `TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B`. 2. Run SendTargets discovery in its normal persistent mode. The default `iscsiadm -m discovery ...` workflow persists records unless nonpersistent mode is selected. 3. Inspect the saved node record and confirm that it contains both the expected `node.name = ...` line and an injected `AAAA...=B` line. 4. Trigger any operation that rereads the node record, such as discovery update, node update, or login. 5. Observe a crash during parsing. With instrumentation enabled, the overflow should be reported in `idbm_recinfo_config()`. Mitigation: Until a fix is available, avoid persistent SendTargets discovery against untrusted or interceptable networks. Where operationally acceptable, use nonpersistent discovery, and remove node records created from untrusted discovery results before later update or login operations. Proposed Fix: The fix should address both parts of the chain: bound the key and value copies in `idbm_recinfo_config()` and reject control characters in `TargetName` before persistence. ```diff diff --git a/usr/idbm.c b/usr/idbm.c @@ void idbm_recinfo_config(recinfo_t *info, FILE *f) while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } + while (*nl && !isspace(c = *nl) && *nl != '=') { + if (i >= NAME_MAXVAL - 1) { + log_warning("Config file line %d key too long", line_number); + break; + } + name[i++] = *nl++; + } @@ while (*nl) { *(value+i) = *nl; i+; nl+; } + while (*nl) { + if (i >= VALUE_MAXVAL - 1) { + log_warning("Config file line %d value too long", line_number); + break; + } + value[i++] = *nl++; + } diff --git a/usr/discovery.c b/usr/discovery.c @@ static int add_target_record(char *name, char *end, discovery_rec_t *drec, while ((nul < end) && (*nul != '\0')) nul++; + for (char *p = name; p < nul; p++) { + if (*p == '\n' || *p == '\r' || (unsigned char)*p < 0x20) { + log_error("TargetName contains control characters, rejecting"); + return 0; + } + } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-19815 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-19788 | 1 Tenda | 2 Ac1206, Ac1206 Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-19790 | 1 Tenda | 1 G0 | 2026-08-14 | 8.8 High |
| A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-63527 | 1 Microsoft | 15 365 Apps, Microsoft 365, Microsoft Office 365 For Mac and 12 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68817 | 1 Microsoft | 10 365 Apps, Excel, Excel 2016 and 7 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68816 | 1 Microsoft | 10 365 Apps, Excel, Excel 2016 and 7 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68795 | 1 Microsoft | 13 365 Apps, Excel, Excel 2016 and 10 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-19003 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-08-13 | 7.8 High |
| A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog. | ||||
| CVE-2026-59086 | 1 Siemens | 1 Simcenter Nastran | 2026-08-13 | 7.8 High |
| A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-43771 | 1 Apple | 1 Macos | 2026-08-13 | 7.1 High |
| A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service. | ||||
| CVE-2026-71407 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-08-13 | 5.1 Medium |
| A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled. | ||||
| CVE-2025-15683 | 1 Tbea | 1 Tbea Tlogger | 2026-08-12 | N/A |
| TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig. | ||||
| CVE-2026-6791 | 1 The Gnu C Library | 1 Glibc | 2026-08-12 | 5.9 Medium |
| When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash. | ||||
| CVE-2024-14042 | 1 Open5gs | 1 Open5gs | 2026-08-12 | 6.3 Medium |
| A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue. The patch is named e89aa79efe629ae90f59dcdf8847c117d9a7da86. It is suggested to upgrade the affected component. | ||||
| CVE-2026-11735 | 1 Netgear | 20 R7000, Rax20, Rax35v2 and 17 more | 2026-08-12 | N/A |
| A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality. | ||||