CVE Vulnerability Catalog

PostgreSQL Anonymizer before 3.3.0 does not mask data returned by a sub-query in a rule. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer before 3.3.0 does not mask data accessed through a security_invoker view. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables, but direct access to partitions is masked while access through the parent table is not. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer before 3.3.0 does not invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see unmasked data until the end of the session.

PostgreSQL restricts access to the salt and shift via the SHOW command for users not in pg_read_all_settings, but they are visible in pg_db_role_setting or pg_roles if set on the database, user, or both. PostgreSQL Anonymizer's documentation recommends using ALTER DATABASE / ALTER ROLE for the salt; the problem is resolved in version 3.3.0.

PostgreSQL's optimized statistics on a table are visible to anyone with SELECT privilege on that table. A masked role can therefore read a limited subset of data through the statistics view's histograms and MCVs.

The anon.image_blur() function in PostgreSQL Anonymizer before 3.3.0 does not check the declared dimensions of the provided image, allowing an attacker to supply a small image with enormous declared dimensions. This can exhaust backend memory and cause an OOM-kill, resulting in cluster-wide crash recovery.

PostgreSQL Anonymizer's range-based dummy functions do not constrain the range size. This can be exploited to exhaust backend memory and OOM-kill it (when overcommit is on), resulting in cluster-wide crash recovery.

PostgreSQL Anonymizer contains a vulnerability where data-modifying CTEs bypass the read-only restriction of masked roles. The problem is resolved in version 3.3.0 and later.

A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.

A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.

A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.

In Grafana, a user with query access to an Azure Monitor data source can cause server-side requests to an attacker-controlled endpoint, disclosing the data source's Azure access token (server-side request forgery).

In Grafana, a user with the Viewer role can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2, allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service. Exploitation occurs via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions, terminating the controller process.

A vulnerability in ethernet_fill_header() in the Zephyr RTOS network stack prepends the Ethernet header in place via net_buf_push without verifying that the packet has sufficient headroom. Packets allocated by a different L2 (e.g., 802.15.4/OpenThread, PPP) and handed to Ethernet through routing or tunnelling have too little (usually zero) headroom, causing an out-of-bounds write. In builds without CONFIG_ASSERT and CONFIG_NET_BUF_HARDENING this results in memory corruption.

A vulnerability in Zephyr's GPIO subsystem is caused by missing validation of the pin argument supplied by a user-mode thread in z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure(). In builds with CONFIG_USERSPACE=y this allows a supervisor-mode out-of-bounds write of a function pointer past a kernel .bss array, as well as out-of-bounds reads and MMIO accesses, potentially leading to kernel memory corruption, arbitrary code execution, or a crash.

A path traversal vulnerability in Ultralytics during Google Drive downloads could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied path before use in file operations. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).

A deserialization of untrusted data vulnerability in the load_dataset_cache_file function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. User interaction is required (visiting a malicious page or opening a malicious file).