CVE Vulnerability Catalog

The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lssz() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor confirmed the vulnerability.

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. An unknown function in the file /sdk/v1 of the eSIM LPA API component leads to improper authorization. The attack can only be initiated within the local network.

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. The function checkDataSetAccess in src/iec61850/server/mms_mapping/mms_mapping.c causes an out-of-bounds read. The attack can be initiated remotely. The exploit has been made public.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the BCFKS keystore load honors unbounded KDF cost from an untrusted file. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In geniezone, a missing permission check allows escalation of privilege. A local attacker with System privileges can escalate further without user interaction.

In geniezone, a missing bounds check allows out-of-bounds write. A local attacker with System privileges can escalate privileges without user interaction.

In geniezone, a missing bounds check allows out-of-bounds read. A local attacker with System privileges can access sensitive information without user interaction.

In the Wi-Fi module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In the Wi-Fi module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In Audio HAL, there is a possible system unresponsiveness due to a race condition. This could lead to local denial of service, requiring User execution privileges. User interaction is not required for exploitation.

In the med module, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service, requiring User execution privileges. User interaction is not required for exploitation.

In the ccci module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In the display module, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In the display module, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In the imgsensor module, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.

In the HFRP module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.