CVE Vulnerability Catalog

Insecure storage of sensitive information in Intel TDX module for some Intel platforms (Ring 0) may allow information disclosure. A privileged attacker with a high complexity attack can access data via local access, without user interaction.

A Cross Site Scripting (XSS) vulnerability in AtHoc IWS Web Portals before version 7.21 HF-734 could allow an attacker to execute actions in the context of the victim's session.

Uncontrolled search paths in Vitis Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution.

Omission of security-relevant information for Intel Software Guard Extensions Data Center Attestation Primitives (Ring 0) may allow denial of service. A privileged attacker with a high complexity attack can alter data via local access, without user interaction.

Improper handling of values in some Intel processors at Ring 0 (kernel, hypervisor, bare metal OS) may allow privilege escalation. An authorized adversary with a privileged user and a high complexity attack can escalate privileges via local access with special internal knowledge and no user interaction. The vulnerability may impact confidentiality and integrity but not availability.

Insufficient granularity of access control in some Intel Xeon 6 Scalable processors with Intel TDX may allow information disclosure. An authenticated adversary with local access and a high complexity attack can expose data without user interaction. The vulnerability has no direct impact on confidentiality, integrity, or availability but may lead to subsequent high confidentiality impact.

Improper handling of overlap between protected memory ranges for some Intel Xeon 6 processors when using Intel TDX within SMM may allow an escalation of privilege. The attack requires a privileged user, high complexity, and special internal knowledge, but no user interaction. The vulnerability impacts confidentiality and integrity (high), with no impact on availability.

Insufficient verification of data authenticity in Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor) may allow information disclosure. A system software adversary with privileged user access and a high complexity attack can expose data without user interaction. The vulnerability impacts confidentiality (high) and integrity (low) but not availability.

Uncontrolled search paths in Vitis Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to execute arbitrary code. The vulnerability stems from improper path management, potentially leading to malicious code execution.

Insufficient input validation in NETGEAR R7000 routers allows authenticated administrators on the local network to make unauthorized modifications to router software and functionality. The vulnerability may lead to integrity breaches of device configuration.

In Vim before 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

Vim, an open source command line text editor, prior to version 9.2.0842 has a vulnerability in the socket server backend in src/socketserver.c that accepts unbounded client connections, causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c. A local process that can connect to the server socket can corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

ToolJet, an open-source platform for building internal tools, prior to version 3.20.207 has a vulnerability in the ToolJet Database HTTP API that authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. An authenticated user can set tj-workspace-id to their own workspace and target another workspace, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker may exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the Endorsement Key (EK). Under certain conditions, this may also enable forgery of TPM 2.0 attestations.

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators.

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website, enabling phishing attacks.

Any authenticated Velociraptor user, including one holding only the reader role, can terminate the entire server process with a single request by calling SetPassword with a username that does not exist.

A flaw was found in the ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP for chunked transfer encoding. The parser uses a single internal variable for both remaining chunk size and state flags, allowing an attacker to craft a request with an extremely large chunk size to overlap these values, tricking the parser into thinking a request has finished prematurely and enabling request smuggling.

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.