SkyFire game server has improper pointer arithmetic enabling memory corruption.
IronOS soldering iron firmware has an integer overflow vulnerability that could cause unexpected behavior in temperature control.
ixray-1.6-stcop game engine has an OOB write vulnerability.
A product has an out-of-bounds write from classic buffer overflow enabling remote code execution.
The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request. [CVSS 5.5 MEDIUM]
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. [CVSS 5.5 MEDIUM]
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive [CVSS 5.5 MEDIUM]
Authentication bypass in Juniper Networks Session Smart Router and Conductor allows network-based attackers to gain administrative control without credentials. The vulnerability affects multiple versions of the routing platform used in enterprise SD-WAN deployments.
xrdp open-source RDP server before v0.10.5 has an unauthenticated stack buffer overflow enabling remote code execution.
xray-monolith game mod has a type confusion vulnerability.
EZCast Pro II v1.17478.146 uses well-known default credentials in the Admin UI enabling immediate administrative access to the wireless presentation system.
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes. [CVSS 8.8 HIGH]
Firefox versions prior to 147.0.2 contain a use-after-free vulnerability in the Layout: Scrolling and Overflow component that can be triggered by user interaction, allowing remote attackers to achieve code execution with high integrity and confidentiality impact. The vulnerability requires network access and user interaction but does not require authentication, making it exploitable through malicious web content. No patch is currently available for this vulnerability.
Ezcast Pro Dongle Ii Firmware versions up to 1.17478.146 is affected by improper input validation (CVSS 8.8).
Ghost is an open source content management system. [CVSS 8.8 HIGH]
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service.
Path traversal in go-tuf versions 2.0.0 through 2.4.0 allows local attackers with low privileges to write metadata files outside the intended cache directory by injecting directory traversal sequences into the repository name parameter. An attacker supplying a malicious map file can escape the LocalMetadataDir boundary and create directories within the process's filesystem permissions. Public exploit code exists; update to version 2.4.1 or later.
Dashboard permission API fails to validate scope boundaries, allowing authenticated users with permission management rights on any single dashboard to read and modify permissions across all organization dashboards. This privilege escalation affects multi-user dashboard environments where permission isolation is expected. No patch is currently available.
Unsafe deserialization in PHPUnit versions before 8.5.52, 9.6.33, 10.5.62, 11.5.50, and 12.5.8 allows local attackers to execute arbitrary code by placing malicious serialized objects in `.coverage` files that are deserialized without validation during PHPT test execution. An attacker with file write access can exploit the `cleanupForCoverage()` method's lack of object class restrictions to trigger gadget chains through `__wakeup()` methods. This high-severity vulnerability (CVSS 7.8) affects developers and CI/CD systems running PHPUnit on Linux systems.
Memory corruption in ThreadX RTOS CreateCounter() function allows local attackers with user privileges to trigger hard faults or corrupt kernel memory by exhausting the counter pool, which causes an unchecked error code to be cast as a wild pointer. The vulnerability stems from incorrect error validation logic that fails to detect counter allocation failures, enabling subsequent writes to arbitrary memory addresses. No patch is currently available.
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access. [CVSS 7.8 HIGH]
An integer overflow vulnerability in yoyofr modizer before version 4.1.1 allows local attackers with user interaction to achieve high-impact compromise including confidentiality, integrity, and availability violations. The vulnerability requires local access and user interaction to trigger, enabling attackers to execute arbitrary code or cause denial of service through integer wraparound conditions. No patch is currently available for this vulnerability.
Out-of-bounds memory read in Rinnegatamante lpp-vita before version r6 allows local attackers with user interaction to read sensitive data, modify memory, or crash the application. The vulnerability requires local access and user interaction to trigger, affecting the integrity and confidentiality of affected systems. No patch is currently available.
ASDA-Soft Stack-based Buffer Overflow Vulnerability [CVSS 7.8 HIGH]
NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. [CVSS 7.8 HIGH]
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. [CVSS 7.5 HIGH]
Unauthenticated remote attackers can crash core system services on Tapo C220 and C520WS cameras by sending specially crafted files to the firmware update endpoint, bypassing authentication and integrity checks. This results in a persistent denial of service condition that requires manual device reboot to restore functionality. No patch is currently available for affected firmware versions.
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. [CVSS 7.5 HIGH]
A memory leak in is-Engine before version 3.3.4 allows remote attackers to cause a denial of service by exhausting server memory without requiring authentication or user interaction. The vulnerability affects all versions of is-Engine prior to 3.3.4 and has a high CVSS score of 7.5 due to its network-accessible nature and ease of exploitation. No patch is currently available for this issue.
Commander-Genius prior to pull request 358 contains an out-of-bounds write vulnerability that allows remote attackers to cause denial of service through network access without authentication or user interaction. The vulnerability stems from improper memory boundary validation in the application, enabling attackers to crash the service or potentially execute arbitrary code. No patch is currently available for this issue.
Ix Ray Engine 1.6 before version 1.3 contains an infinite loop vulnerability that allows remote attackers to cause denial of service without authentication or user interaction. The flaw stems from an unreachable exit condition in a processing loop, enabling attackers to exhaust system resources and render the application unresponsive. No patch is currently available for this high-severity issue.
Uncontrolled buffer expansion in Suricata's DCERPC parser allows remote attackers to trigger unbounded memory allocation and cause denial of service by sending specially crafted DCERPC traffic. The vulnerability affects versions prior to 8.0.3 and 7.0.14 across DCERPC/UDP, DCERPC/TCP, and SMB protocols, with TCP being partially protected by default stream depth limits. Patches are available, and administrators can mitigate by disabling vulnerable parsers or configuring stream reassembly depth limits.
web-based management interface of HPE Aruba Networking Fabric Composer is affected by path traversal (CVSS 7.5).
Out-of-band SQL injection in the Evaluacion De Desempeno application's 'Id_usuario' parameter allows unauthenticated remote attackers to extract sensitive database information through covert channels, bypassing normal application output mechanisms. This vulnerability affects the '/evaluacion_objetivos_ver_auto.aspx' endpoint and compromises data confidentiality with no patch currently available.
Unauthenticated attackers can exploit an out-of-band SQL injection flaw in the Evaluacion De Desempeno application's 'Id_evaluacion' parameter to extract sensitive database information through indirect data exfiltration channels. This network-accessible vulnerability requires no user interaction and affects all instances without authentication controls, potentially exposing confidential evaluation records. No patch is currently available.
Out-of-band SQL injection in the Performance Evaluation (Evaluacion De Desempeno) application allows unauthenticated remote attackers to extract sensitive database information through the 'Id_usuario' parameter in '/evaluacion_objetivos_anyo_sig_ver_auto.aspx' by exfiltrating data via external channels. The vulnerability compromises data confidentiality without requiring user interaction, affecting all deployments of the affected application. No patch is currently available.
Out-of-band SQL injection in the Evaluacion De Desempeno application's 'Id_usuario' parameter allows unauthenticated remote attackers to extract sensitive database information through external data exfiltration channels. This vulnerability affects the '/evaluacion_objetivos_anyo_sig_evalua.aspx' endpoint and compromises confidentiality without requiring user interaction. No patch is currently available.
Out-of-band SQL injection in Evaluacion De Desempeno's '/evaluacion_hca_ver_auto.asp' endpoint allows unauthenticated remote attackers to extract sensitive database information through the 'Id_usuario' and 'Id_evaluacion' parameters. The vulnerability compromises confidentiality by enabling data exfiltration via covert channels without requiring direct application responses. No patch is currently available for affected deployments.
Unauthenticated attackers can exploit an out-of-band SQL injection flaw in the Performance Evaluation (EDD) application via the 'Id_usuario' and 'Id_evaluacion' parameters to extract sensitive database information through external channels, compromising data confidentiality. The vulnerability requires no user interaction and is remotely exploitable from the network. No patch is currently available.
Out-of-band SQL injection in the Evaluacion De Desempeno application allows unauthenticated remote attackers to extract sensitive database information through the 'Id_usuario' and 'Id_evaluacion' parameters in the '/evaluacion_competencias_evalua_old.aspx' endpoint. An attacker can bypass normal application output channels to exfiltrate confidential data, compromising database confidentiality. No patch is currently available for this vulnerability.
Out-of-band SQL injection in the Evaluacion De Desempeno application's 'Id_usuario' parameter allows unauthenticated remote attackers to extract sensitive database information through indirect data exfiltration channels. This vulnerability in the '/evaluacion_acciones_ver_auto.aspx' endpoint compromises the confidentiality of stored data without requiring user interaction. No patch is currently available for this HIGH severity vulnerability.
Unauthenticated attackers can extract sensitive database information from the Evaluacion De Desempeno application through an out-of-band SQL injection vulnerability in the 'Id_usuario' parameter of '/evaluacion_acciones_evalua.aspx'. The vulnerability allows data exfiltration via external channels without direct application responses, compromising database confidentiality. No patch is currently available for this high-severity flaw.
Out-of-band SQL injection in the Performance Evaluation (EDD) application allows unauthenticated remote attackers to extract sensitive database information through the 'Id_usuario' and 'Id_evaluacion' parameters in '/evaluacion_inicio.aspx'. An attacker can exfiltrate confidential data via external channels without direct application feedback, compromising data confidentiality. No patch is currently available for this vulnerability.
Out-of-band SQL injection in the Evaluacion De Desempeno application's 'Id_usuario' parameter allows unauthenticated remote attackers to exfiltrate sensitive database information through covert channels. The vulnerability affects the '/evaluacion_competencias_evalua.aspx' endpoint and enables unauthorized access to confidential data despite the application not directly returning query results. No patch is currently available for this HIGH severity vulnerability.
Out-of-band SQL injection in the Evaluacion De Desempeno application allows unauthenticated remote attackers to extract sensitive database information through the 'txAny' parameter in '/evaluacion_competencias_autoeval_list.aspx' without direct output reflection. By leveraging external data channels, an attacker can bypass normal application responses to exfiltrate confidential data and compromise database confidentiality. No patch is currently available for this vulnerability.
Suricata versions 8.0.0 through 8.0.2 are susceptible to a stack overflow crash when processing network traffic with improperly configured body size limits. An unauthenticated remote attacker can trigger a denial of service by sending crafted requests that exceed the application's stack capacity. A patch is available in version 8.0.3, or administrators can apply the workaround of using default values for request-body-limit and response-body-limit configurations.
Grafana is vulnerable to denial of service through resource exhaustion when processing uncached avatar requests with random hashes. Sustained requests cause goroutines to accumulate indefinitely due to timeout handling issues, eventually consuming all available memory and crashing the application. An unauthenticated remote attacker can exploit this vulnerability without user interaction to render affected Grafana instances unavailable.
Incorrect rounding in the mulDiv() function of soroban-fixed-point-math versions 1.3.0 and 1.4.0 allows attackers to manipulate fixed-point arithmetic results in Soroban smart contracts by exploiting sign handling when both the intermediate product and divisor are negative. This affects all signed FixedPoint implementations (i64, i128, I256) and could enable financial miscalculations or loss of funds in dependent contracts. A patch is available in versions 1.3.1 and 1.4.1.
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. [CVSS 7.4 HIGH]