Vulnérabilités récentes · Page n° 183

Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing

An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled

An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

X.Org Server GestureBuildSprite Use-After-Free

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

• Mettez à jour vers 21.1.25
• Mettez à jour vers 24.1.14
• Mettez à jour vers 2:21.1.25-1
• Mettez à jour vers 2:24.1.14-1

Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification

An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.

• Mettez à jour vers 7.0.5
• Mettez à jour vers 7.1.7
• Mettez à jour vers 7.2.3

X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read

A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.

• Mettez à jour vers 21.1.25
• Mettez à jour vers 24.1.14
• Mettez à jour vers 2:21.1.25-1
• Mettez à jour vers 2:24.1.14-1

Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues: - CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv` (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allo

• Mettez à jour vers 4.800.0-150700.3.9.1

X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

• Mettez à jour vers 21.1.25
• Mettez à jour vers 24.1.14
• Mettez à jour vers 2:21.1.25-1
• Mettez à jour vers 2:24.1.14-1

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

• Mettez à jour vers 5.12.0

X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

• Mettez à jour vers 21.1.25
• Mettez à jour vers 24.1.14
• Mettez à jour vers 2:24.1.14-1

Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

An improper access check allows unauthorized access to com_config webservice endpoints.

FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute c