CVE Vulnerability Catalog

NanoMQ, an MQTT broker, prior to 0.24.14 has an MQTT v5 property decoder that walks the entire linked list for each property added, resulting in O(N²) complexity. A remote unauthenticated client can send a PUBLISH or SUBSCRIBE packet with many User Properties, causing excessive CPU usage and broker unresponsiveness.

libheif, a HEIF and AVIF decoder and encoder, prior to 1.19.6 has an integer overflow in the width field of Op_RGB24_32_to_YCbCr::convert_colorspace() for extremely large RGB images. This causes an invalid input pointer and an out-of-bounds read during RGB-to-YCbCr conversion, potentially crashing the encoding process.

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who meets certain device state conditions could make this service remotely accessible.

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted.

SveltyCMS 0.0.6 contains a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, in the file src/utils/media/media-service.server.ts. Input manipulation can lead to malicious script execution, and the attack can be initiated remotely.

The gptp_handle_msg() function in Zephyr RTOS does not validate the received frame length before dereferencing the gPTP header pointer. A truncated frame can lead to out-of-bounds reads, disclosing stale memory contents.

rustls-webpki versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accept permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com is treated as satisfied by a certificate for *.example.com, which could assert reject.example.com outside the permitted subtree.

rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, accepting rather than enforcing them. These constraints apply to otherwise properly issued certificates, so the flaw is reachable after successful signature verification and requires a misissued certificate.

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process).

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers.

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

A vulnerability in the Auto block feature in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks. The issue stems from improper restriction of excessive authentication attempts.

An SQL Injection vulnerability in the EventScheduler API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.

A CRLF Injection vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.