CVE Vulnerability Catalog

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting services. Exploitation requires user interaction – the victim must open a malicious file.

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting services. Exploitation requires user interaction – the victim must open a malicious file.

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

Fortinet FortiWeb (versions 8.0.0–8.0.3, 7.6.0–7.6.6, 7.4.0–7.4.11, all 7.2, all 7.0) contains a stack-based buffer overflow. A remote authenticated attacker able to bypass stack protection and ASLR can execute arbitrary code or commands via crafted HTTP requests.

Fortinet FortiDeceptor (versions 6.2.0, all 6.0, all 5.3, all 5.2, all 5.1, all 5.0, all 4.3, all 4.2, all 4.1, all 4.0) contains improper neutralization of argument delimiters in a command (argument injection). A privileged attacker with the super-admin profile and CLI access can delete sensitive files via crafted HTTP requests.

Fortinet FortiWeb (versions 8.0.0–8.0.2, 7.6.0–7.6.6, all 7.4, all 7.2, 7.0.2–7.0.12) contains a stack-based buffer overflow (CWE-121). A remote authenticated attacker able to bypass stack protection and ASLR can execute arbitrary code or commands via crafted HTTP requests.

The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.

A deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity, and potential remote code execution on a workstation when an admin authenticated user opens a malicious project file.

A Cross-site Scripting (CWE-79) vulnerability exists that allows authenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

A CWE-404 vulnerability exists related to improper resource shutdown or release, which could lead to a partial Denial of Service attack on the Machine Expert protocol. An unauthenticated attacker can send a malicious payload to occupy active communication channels.

W wyniku braku sprawdzenia autoryzacji w serwerze aplikacyjnym SAP NetWeaver dla ABAP, uwierzytelniony atakujący z uprawnieniami użytkownika mógł odczytać pliki dziennika analizy bazy danych za pomocą konkretnego modułu funkcji RFC. Atakujący z odpowiednimi uprawnieniami do wykonania tego modułu funkcji mógł potencjalnie podnieść swoje uprawnienia i uzyskać dostęp do wrażliwych danych.

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker can persuade a victim to place a malicious DLL in one of these directories, and the malicious command executes in the victim's context if GuiXT is enabled.

SAP NetWeaver Application Server dla ABAP udostępnia raport ABAP do celów testowych, który pozwala na wysyłanie żądań HTTP do dowolnych wewnętrznych lub zewnętrznych punktów końcowych. Raport ten jest podatny na atak typu Server-Side Request Forgery (SSRF).

W wyniku braku weryfikacji uprawnień w serwerze aplikacji SAP NetWeaver dla ABAP, uwierzytelniony atakujący mógłby wykonać określony moduł funkcji ABAP, aby odczytać, zmodyfikować lub wprowadzić wpisy do tabeli konfiguracyjnej bazy danych systemu ABAP. Zmiana ta może prowadzić do obniżonej wydajności systemu lub przerw w jego działaniu.

In Mitsubishi Electric CNC series M800V, M80V, M800, M80, E80, C80, M700V, M70V, and E70, there is a vulnerability due to improper validation of index, position, or offset in input. A remote attacker can send specially crafted packets to TCP port 683, causing an out-of-bounds read and resulting in a denial-of-service condition.

A path traversal vulnerability in Camaleon CMS versions 2.4.5.0 through 2.9.0 (prior to commit f54a77e) in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from the web server's filesystem by manipulating the 'file' parameter in the download_private_file function.

In the Linux kernel, a vulnerability was found in the fremovexattr() syscall where the error path of strncpy_from_user() misses a fdput() call. This causes a permanent file reference leak, which in multi-threaded processes can lead to kernel memory exhaustion.

GNU Binutils through 2.45.1 contains a denial-of-service vulnerability in readelf when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning without forward progress, resulting in a non-terminating output loop requiring manual interruption. No evidence of memory corruption or code execution was observed.

GNU Binutils readelf through 2.45.1 contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw causes readelf to repeatedly print the same table output without progress, resulting in an unbounded output loop.

In AWS Auth Manager, the origin of SAML authentication was taken from the client without verification against the actual instance URL. This allowed gaining access to different instances with potentially different access controls by reusing SAML responses from other instances.