CVE Vulnerability Catalog

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of VTK version 9.6.1. A specially crafted .bmp file can lead to a buffer overflow.

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of VTK version 9.6.1. A specially crafted USGS DEM file can lead to a buffer overflow.

ServiceNow addressed a domain separation bypass security issue in the ServiceNow SR – CSM – Task Plan Templates Store application. The vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. ServiceNow is not currently aware of malicious exploitation against ServiceNow instances.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.

WiFiman Desktop for macOS contains an Improper Access Control vulnerability. A malicious actor with local access and high privileges could exploit it to escalate privileges on the host device.

A vulnerability in WiFiman Desktop involves external control of file name or path. A malicious actor with local access and low privileges could exploit this flaw to execute arbitrary commands with root privileges on the host device.

A vulnerability in WiFiman Desktop involves binding to an unrestricted IP address. A malicious actor with network access could exploit this flaw to obtain information about the host device.

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration. A malicious workload may change permissions and ownership of host directories.

In node-forge before 1.4.1, a PKCS#12 MAC or password-based encryption iteration count of zero or less was accepted. pki.pbe.generatePkcs12Key() then returned a constant key independent of password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected.

In node-forge before 1.4.1, the bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue.

In node-forge prior to 1.4.1, pki.verifyCertificateChain() modified the CA store while testing certificates sharing a subject name. A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail.

In node-forge before 1.4.1, pem.decode() in lib/pem.js used polynomial-time regular expressions, including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service.

In node-forge before 1.4.1, the TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This affects forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange.

In node-forge before 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected.

In node-forge prior to 1.4.1, PKCS#7 padding validation during CBC and ECB decryption checked only the final padding byte. Zero, oversized, or mismatched padding bytes were accepted, potentially silently removing up to four plaintext blocks.

In node-forge prior to 1.4.1, asn1.oidToDer() did not range-check the first two arcs of an OID. An application accepting an untrusted OID string, checking it, and then encoding it with asn1.oidToDer() could emit DER representing a different, trusted OID.