CVE Vulnerability Catalog

A flaw in the openshift-ansible installer container's `run` script causes remote inventory and dynamic scripts to be downloaded and executed without integrity verification. A remote attacker performing a Man-in-the-Middle attack or compromising the HTTP server providing these scripts could substitute an arbitrary executable, which would then run with the installer's UID and full cluster-provisioning privileges.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In pyasn1 prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 with large mantissas causes quadratic decode time, holding a decoding worker on one CPU core for seconds or longer and causing availability loss.

In pyasn1 prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input with many constructed BIT STRING fragments causes quadratic CPU work during decode().

In pyasn1 prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data with many fragments causes quadratic CPU work during decode().

In pyasn1 from 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input with many distinct long tag IDs whose TagSet hashes collide causes quadratic CPU work during decoding.

In node-forge prior to 1.4.1, ASN.1 decoding inside BIT STRING values did not consistently apply the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer().

In node-forge prior to 1.4.1, deprecated extension OIDs 2.5.29.10 and 2.5.29.13 were parsed as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. If a trusted CA issues a certificate carrying an attacker-supplied deprecated-OID extension before the genuine basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names.

In node-forge prior to 1.4.1, forge.tls.createConnection() continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail.

In node-forge prior to 1.4.1, received TLS records were processed recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service.

A heap-based buffer overflow exists in the vtkWindBladeReader FindVariableOffsets functionality of VTK version 9.6.1. A specially crafted .wind file can trigger a buffer overflow.

An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of VTK version 9.6.1. A specially crafted chaco file can trigger an out-of-bounds read.

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of VTK version 9.6.1. A specially crafted .bmp file can lead to a buffer overflow.

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of VTK version 9.6.1. A specially crafted USGS DEM file can lead to a buffer overflow.

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.

A vulnerability in WiFiman Desktop involves external control of file name or path. A malicious actor with local access and low privileges could exploit this flaw to execute arbitrary commands with root privileges on the host device.

A vulnerability in WiFiman Desktop involves binding to an unrestricted IP address. A malicious actor with network access could exploit this flaw to obtain information about the host device.

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration. A malicious workload may change permissions and ownership of host directories.