Threats Tagged 'cwe-706'

A critical vulnerability (CVE-2026-92262) exists in MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. The issue involves the #mysql50# bypass prefix, which allows bypassing normal table-name filesystem encoding. An attacker can exploit this to cause crashes, data corruption, data exfiltration, or remote code execution. The vulnerability has a CVSS score of 9.9 and is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user. The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability in the ACL cache. The cache could generate the same database-privilege cache key for role and localhost user names that matched due to an empty IP component, allowing an attacker with CREATE USER privileges to create a colliding principal and potentially exercise privileges assigned to another account. This issue has been fixed in the specified fixed versions.

CVE-2026-85491 affects Catalyst::Seal versions before 0.03 for Perl and involves an incomplete comparison vulnerability in the dispatch memoization mechanism. The memoization key uses only the request path, ignoring other factors like HTTP method, content type, scheme, or query parameters. This can cause authorization checks to be bypassed by replaying memoized dispatch results from different request contexts. The memo entries persist for the life of the process, allowing one request to disable or misroute subsequent requests, potentially skipping authorization checks. The vulnerability has a high severity with a CVSS score of 8.8.

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-47843 is a low-severity vulnerability in Spring Reactor Netty where, under certain conditions involving multiple clients with different DNS resolver configurations, the system may incorrectly reuse a previously configured DNS resolver. This affects specific versions of Reactor Netty including 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier. The vulnerability is classified under CWE-706, indicating the use of an incorrectly-resolved name or reference. No official patch or remediation guidance has been provided yet.

CVE-2026-65816 is a critical vulnerability in Microsoft Azure Web Apps involving the use of incorrectly-resolved names or references in Azure Arc. This flaw allows an unauthorized attacker to elevate privileges over a network, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service. There are no known exploits in the wild at this time.

CVE-2026-13097 is a critical privilege escalation vulnerability in FreeIPA on Red Hat Enterprise Linux 9. It is caused by improper enforcement of uniqueness constraints on Kerberos principal names in the 389-ds directory server. This flaw allows a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged principal, potentially leading to unauthorized acquisition of Kerberos service tickets and full domain compromise. Red Hat has released an update for FreeIPA in Red Hat Enterprise Linux 9.8 to address this issue.

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-13437#cwe-706