CVE Vulnerability Catalog

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a null pointer dereference.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.

IBM Virtualization Management Interface versions FW1110.00-FW1110.30, FW1120.00, and FW1060.00-FW1060.80 contain a vulnerability allowing an authenticated administrator to crash the VMI. The interface restarts automatically, but repeated exploitation could cause sustained availability impact.

Tapo C100/C101 V5 has a heap-based buffer overflow in the RTSP service. An authenticated attacker on the local network can send crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, leading to temporary denial of service.

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot.

Snipe-IT prior to 8.6.2 has a stored XSS vulnerability in manufacturer or supplier names. A crafted name can execute JavaScript when an authenticated user views the detail page, potentially exposing data or actions available to that session.

Snipe-IT prior to 8.6.3 allows any activated account to read maintenance records for assets in the same company without asset or maintenance permission. The show() method lacks authorization, disclosing asset tags, suppliers, purchase costs, notes, and dates.

Snipe-IT prior to 8.6.3 has a vulnerability that allows a restricted user to obtain another user's randomized EULA filename and download the signed file. The /stored-eula-file/{filename} and /account/stored-eula-file/{filename} routes do not consistently enforce ownership and target-user authorization.

Snipe-IT prior to 8.4.1 allows an authenticated user with generic asset edit permission to delete files attached to assets outside their ownership or company. The destroy() methods authorize against the object class instead of the instance, creating an insecure direct object reference.

Snipe-IT prior to 8.4.1 allows a non-superadmin to submit company_id directly in the update() method of BulkAssetsController, bypassing Company::getIdForCurrentUser(). This allows assets to be moved across company boundaries, breaking multi-tenant isolation.

Snipe-IT prior to 8.5.0 allows a user who can edit other users to reset a superadmin's two-factor authentication. The postTwoFactorReset() endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled.

Snipe-IT prior to 8.6.1 allows a user with import permission to overwrite a non-admin user's email via CSV update mode and then request a password reset to take over the account. UserImporter strips unauthorized fields, but ItemImporter restores them from the raw CSV row, and the import path does not require users.edit.

Snipe-IT prior to 8.6.1 has a vulnerability in POST /two-factor with no rate limiting, lockout, or attempt counter, allowing unlimited TOTP guesses. It also allows disabling 2FA without OTP reverification in certain modes.

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful exploitation could result in limited confidentiality or availability impacts to the affected host system.

IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.

In FreeRDP before 3.28.0, rdpsnd_server_recv_formats frees context->client_formats on a malformed Client Audio Formats PDU without clearing the pointer or count. An authenticated RDP client can trigger an error, leaving a dangling pointer, leading to a double-free at session teardown. This can crash the server and cause heap corruption.