Improper Validation in Exynos NPU Driver Causes Out-of-Bounds Write and Denial of Service

In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.

kernel: kernel: Memory corruption via integer overflow in Samsung Exynos NPU driver

In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.

Subnet Solutions PowerSYSTEM Center SQL Injection

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Improper Permission Handling in Buffer Operations Enables Unauthorized Memory Mappings

Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions

Denial of Service Vulnerability in Exynos Modem IMS Stack Due to SDP Payload Handling

In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service

Out-of-Bounds Race Condition in PPC of Exynos Processors

Out of bound access in PPC due to race condition in global variable access

Improper Message Validation Leads to Memory Corruption in Samsung Exynos SoCs

A memory corruption vulnerability caused by improper validation of messages

NR RRC Message Handling Vulnerability Causes Denial of Service in Samsung Exynos Processors

In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

Buffer Overwrite via NAS Message Length Validation Flaw in Samsung Exynos Processors

In the NAS message handler, improper validation of the length field in NAS message causes memory corruption

Improper SIP Packet Handling Causing Access Control Bypass in Samsung Exynos IMS Stack

In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability

Baseband Memory Corruption Leading to Denial of Service in Samsung Exynos Modems

In the baseband, memory corruption during NAS packet processing can cause a denial of service.

In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.

In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

NAS Authentication Request Decoding Infinite Loop Causes Denial of Service on Exynos Processors

In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.

Malicious IMS Message Leading to Information Exposure via SIP Flow

An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.

DoS via Malformed RRC Reconfiguration Message in Samsung Exynos Modems

Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().

XML External Entity Processing Enables Remote Local File Disclosure in Wowza Streaming Engine

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.

OS Command Injection in OPNsense os‑acme‑client Allows Root Execution via Google Cloud DNS Validation

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.