CVE Vulnerability Catalog

The illumos zones statistics daemon (zonestatd) lacks an authorization check, allowing a local user in any zone to disrupt zonestat in other zones and determine which zones are running. The zsd_server() procedure handles the ZSD_CMD_NEW_ZONE command without checking the caller's credentials, allowing an unprivileged user to send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, potentially causing new zonestat requests to fail. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone.

The Affinity by Canva app for macOS before version 3.3.1 did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

The Affinity by Canva application for macOS before 3.3.1 did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A crafted Affinity document, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

The Affinity by Canva app before 3.3.1 did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A crafted Affinity document, when opened by a user in Affinity, could result in an application crash.

The Affinity by Canva application before 3.3.1 did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application before 3.3.1 did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to information disclosure and exposure.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to information tampering and protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could exploit this vulnerability, leading to information exposure and information tampering.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to information tampering.

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record. This allows an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

A NULL pointer dereference in OpenPrinting CUPS before 2.4.20 caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues.

A double-free in printer-class management in OpenPrinting CUPS before 2.4.20. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service.

A resource-exhaustion vulnerability in OpenPrinting CUPS through 2.4.20 in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring.

Strawberry GraphQL versions 0.312.3 through 0.327.2 do not remove completed operations from task and subscription lists in the legacy graphql-ws handler. With a configured per-connection subscription limit, a client can exhaust the limit, blocking later legitimate operations. Fixed in version 0.327.2.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 store sensitive information in cleartext in logs. A local attacker can access this data.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to denial of service due to a heap-based out-of-bounds read. A remote attacker can send a specially crafted request causing a limited out-of-bounds memory read.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery. An attacker can manipulate logs to hide their actions.

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. For strings near 4 GiB, allocation can wrap while copy uses original length, causing heap buffer overflow. Requires non-default runtime configuration allowing multi-gigabyte values.