CVE Vulnerability Catalog

Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

OpenEXR versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds write. When a crafted B44-compressed scanline EXR causes the logical scratch size to truncate before allocation and uncompress_b44_impl() writes using the attacker-controlled channel width, allowing denial of service and memory corruption. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Reachy Mini SDK before version 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS, allowing an unauthenticated attacker to upload arbitrary files to /tmp/reachy_mini_sounds/. This issue is fixed in version 1.8.2.

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application. Exploitation requires user interaction – the victim must open a malicious file.

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.

NVIDIA DGX Spark contains a vulnerability in UEFI where a privileged local user can cause a CWE-693, potentially allowing bypass of administrator password protection in UEFI. Successful exploitation may allow an attacker to bypass password protections.

NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could cause an out-of-bounds read. Successful exploitation might lead to information disclosure.

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection via crafted API requests. Successful exploitation may lead to code execution, privilege escalation, and information disclosure.

NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands via a crafted API request. Successful exploitation might lead to code execution, privilege escalation, and information disclosure.

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. Successful exploitation might lead to information disclosure and privilege escalation.

An integer overflow vulnerability leading to an out-of-bounds write was discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file.

An integer conversion vulnerability leading to an out-of-bounds read when loading images was discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file.

The Zephyr ext2 filesystem driver contains an out-of-bounds read vulnerability triggered when mounting a crafted ext2 image. The ext2_bitmap_count_set() function scans memory based on unvalidated superblock values, potentially reading about 512 MB past the bitmap buffer.

A vulnerability in the OCPP 1.6 client in Zephyr (subsys/net/lib/ocpp/ocpp.c) causes a NULL pointer dereference when processing CALLRESULT messages. A server can send a uid without a '-' delimiter, leading to atoi(NULL) and a crash of the OCPP reader thread. The flaw is remotely reachable via a malicious or compromised central system or MITM on a ws:// connection.

The virtio PCI driver in Zephyr OS (drivers/virtio/virtio_pci.c) improperly validates the capability length (cap_len) read from PCI configuration space. The lack of runtime validation (assert is disabled in production builds) leads to an out-of-bounds write on the kernel stack during device initialization.

X-AnyLabeling's model downloader disabled TLS certificate verification. The download_with_retry function uses an unverified SSL context, allowing an attacker to intercept the connection and replace the downloaded model. The substituted file can be used to execute arbitrary code or influence annotation results.

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like '../root-secret.txt' to escape the bucket namespace and access files in the serve root directory.

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.