CVE Vulnerability Catalog

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation depends on conditions beyond the attacker's control. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation does not require user interaction.

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation does not require user interaction.

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation does not require user interaction. Scope is changed.

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign live `resultId`. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant `result` only by `resultId`. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue.

Improper neutralization of special elements used in a command (command injection) in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys.

Missing authentication for a critical function in the Windows RPC API allows an authorized attacker to elevate privileges locally.

Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 may allow an escalation of privilege. An unprivileged adversary with an unauthenticated user and low complexity attack may enable privilege escalation. This may occur via network access without user interaction. Impact on confidentiality, integrity, and availability is low.

A Use of Hard-coded Cryptographic Key vulnerability could result in a security feature bypass. A low-privileged attacker could bypass security measures and gain unauthorized read and write access. Exploitation does not require user interaction, and scope is changed.

Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 may allow an escalation of privilege. An unprivileged adversary with an authenticated user and high complexity attack may enable privilege escalation. This may occur via local access and requires passive user interaction. Impact on confidentiality, integrity, and availability is high.

Path traversal vulnerability in gaudi-container-runtime before version 1.24.0 may allow privilege escalation. An attacker with an authenticated user and a low complexity attack can exploit this locally, requiring passive user interaction. The impact on confidentiality, integrity, and availability is high.

An Incorrect Authorization vulnerability could result in privilege escalation. A low-privileged attacker could gain unauthorized read and write access. Exploitation does not require user interaction.

Stack-based buffer overflow in Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow denial of service. An unprivileged software adversary with an unauthenticated user and low complexity attack may enable DoS. This may occur via adjacent access without user interaction. Availability impact is high.

Improper buffer restrictions in Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow denial of service. An unprivileged software adversary with an unauthenticated user and low complexity attack may enable DoS. This may occur via adjacent access without user interaction. Integrity impact is low, availability high.

An Improper Input Validation vulnerability could result in a security feature bypass. An attacker could bypass security measures and gain unauthorized read and limited write access. Exploitation does not require user interaction.

An Improper Input Validation vulnerability could result in privilege escalation. A low-privileged attacker could gain unauthorized read and write access. Exploitation requires user interaction – the victim must open a malicious file. Scope is changed.

Improper access control in the firmware for Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow privilege escalation. A privileged user with a high complexity attack may enable escalation. This may occur via local access without user interaction. Confidentiality and integrity impact are high.

Improper authentication in Intel(R) PROSet/Wireless WiFi Software for Windows may allow an escalation of privilege. An unprivileged attacker with an unauthenticated user and a low complexity attack may enable local code execution. The attack requires local access, no user interaction, and may impact confidentiality, integrity, and availability.