CVE Vulnerability Catalog

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a truncated TGA can leave a pending GIF frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the GIF palette.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted PSD with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, an indexed PSD with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. When oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, an uncompressed 16-bit IFF image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. The oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted Cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted FITS stream containing consecutive 2880-byte header blocks without the mandatory END keyword makes fitsinput::read_fits_header() call itself without a depth bound. Repeated recursive parsing exhausts the application stack.

In http4k prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefore receive weaker MD5-based verification.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM WebSphere Application Server (versions 9.0 and 8.5) could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) transmits data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.

IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Cognos Analytics (versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2) stores sensitive information in source code, which could be used by an authenticated user in further attacks against the system.

IBM TS4300 versions 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.