CVE Vulnerability Catalog

Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can write integer-indexed values onto Object.prototype or the Object constructor, affecting array and object reads and for-in enumeration throughout the page. This is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.

Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, creating an enumerable property visible on every object that can throw and break features such as extremes synchronization. The issue affects versions 1.0.0 through 4.2.2 and is fixed in 4.2.2.

PostgreSQL Anonymizer before 3.3.0 leaves statistics about the original data visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This can expose information about masked data.

The anon.partial() and anon.partial_email() functions in PostgreSQL Anonymizer before 3.3.0 can reveal the whole data if the data is small enough. The issue is fixed in version 3.3.0.

PostgreSQL Anonymizer before 3.3.0 mishandles anonymization functions defined using SQL-standard function bodies. PostgreSQL analyzes such functions at declaration time while Anonymizer only checks them at execution time, which can be exploited by any user with the TEMPORARY privilege.

PostgreSQL Anonymizer before 3.3.0 does not mask data returned by a sub-query in a rule. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer before 3.3.0 does not mask data accessed through a security_invoker view. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables, but direct access to partitions is masked while access through the parent table is not. The problem is resolved in version 3.3.0.

PostgreSQL Anonymizer before 3.3.0 does not invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see unmasked data until the end of the session.

PostgreSQL restricts access to the salt and shift via the SHOW command for users not in pg_read_all_settings, but they are visible in pg_db_role_setting or pg_roles if set on the database, user, or both. PostgreSQL Anonymizer's documentation recommends using ALTER DATABASE / ALTER ROLE for the salt; the problem is resolved in version 3.3.0.

The anon.image_blur() function in PostgreSQL Anonymizer before 3.3.0 does not check the declared dimensions of the provided image, allowing an attacker to supply a small image with enormous declared dimensions. This can exhaust backend memory and cause an OOM-kill, resulting in cluster-wide crash recovery.

PostgreSQL Anonymizer's range-based dummy functions do not constrain the range size. This can be exploited to exhaust backend memory and OOM-kill it (when overcommit is on), resulting in cluster-wide crash recovery.

A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.

A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.

In Grafana, a user with the Viewer role can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

A vulnerability in ethernet_fill_header() in the Zephyr RTOS network stack prepends the Ethernet header in place via net_buf_push without verifying that the packet has sufficient headroom. Packets allocated by a different L2 (e.g., 802.15.4/OpenThread, PPP) and handed to Ethernet through routing or tunnelling have too little (usually zero) headroom, causing an out-of-bounds write. In builds without CONFIG_ASSERT and CONFIG_NET_BUF_HARDENING this results in memory corruption.

A heap-based buffer overflow in Bluetooth OBEX packet handling exists in Alpine iLX-F511 devices, caused by lack of validation of user-supplied data length before copying to a heap buffer. A physically present attacker can execute arbitrary code as root without authentication.

A stack-based buffer overflow in the Android Auto connection handler of Alpine iLX-F511 devices allows a physically present attacker to execute arbitrary code. The lack of validation of user-supplied data length before copying to a fixed-length stack buffer enables remote code execution with root privileges.

A command injection vulnerability in the diagapp component of Alpine iLX-F511 devices allows a physically present attacker to execute arbitrary code. The lack of validation of a user-supplied string before using it in a system call enables code execution with root privileges.

A stack-based buffer overflow in the framework service of Alpine iLX-F511 devices allows a physically present attacker to execute arbitrary code. The lack of validation of user-supplied data length before copying to a fixed-length stack buffer enables remote code execution with root privileges.