| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses the AG's +CIND: response in cind_handle(), which assigns a per-entry counter index and calls cind_handle_values() for each list element. cind_handle_values() then wrote hf-ind_table[index] = i without verifying that index is within the 20-element int8_t ind_table[] array of struct bt_hfp_hf. Because the parser places no cap on the number of +CIND: list entries, a remote Attendant Gateway (a malicious, compromised, or spoofed peer the device connects to over Bluetooth) can send a response with more than 20 recognized indicator entries and drive index arbitrarily large, writing a small attacker-positioned value past the array into adjacent struct fields (feature masks, SDP/version state, the calls[] array, work/atomic bookkeeping) and potentially beyond the static connection pool slot. This yields memory corruption and at least denial of service of the Bluetooth host, triggered by a single malformed AT response with no user interaction. The sibling consumer ag_indicator_handle_values() already performed the equivalent bounds check; this commit adds the same index = ARRAY_SIZE(hf-ind_table) guard to close the gap. Affects builds with CONFIG_BT_HFP_HF enabled; introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0. |
| Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint. |
| Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. |
| Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| Unauthenticated Local File Inclusion in Granola <= 1.13 versions. |
| Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Shareaholic: from n/a through 9.7.11. |
| Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
| Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
| Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
| Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
| Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. |
| Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
| Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. |
| Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
| Unauthenticated Local File Inclusion in Gat <= 1.16 versions. |
| Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions. |
| Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions. |
| Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
| Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions. |
