CVE Vulnerability Catalog

A vulnerability in CoffeeZip version 4.8.0.0 by OhSoft allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

In ExpressZip v11.29 by NCH Software, a vulnerability allows attackers to execute arbitrary code by downloading and running a crafted archive file.

Question2Answer through version 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access after a password reset, because the forgot-password flow does not clear the sessioncode field.

The MIME header parsing code in Thunderbird when forwarding a message (with the setting to view all headers enabled) has an off-by-one error, allowing a single byte to be read from memory after the header buffer, potentially crashing Thunderbird. Fixed in Thunderbird 153 and Thunderbird 140.13.

In Compass, when importing connections, it is possible to override connection options that normally cannot be changed via the connection form. In particular, a custom browser open command for OIDC auth flow can be provided, which is usually only set globally in Compass settings.

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

An authenticated low-privileged user may perform unauthorized reads and writes on data protected by role-based query-level access controls due to insufficient validation of client-supplied command parameters. This affects find, update, delete, and aggregate commands in non-apiStrict configurations.

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder. An attacker can supply a crafted ADX or AAX audio file with a mid-stream channel layout change, causing the use of a stale channel count and out-of-bounds memory access.

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer (libavformat/rtpdec_asf.c). The rtp_asf_fix_header function fails to validate a minimum chunksize, allowing a remote attacker to send a crafted RTP/ASF stream causing CPU exhaustion and denial of service.

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer. An attacker can supply a crafted DTS stream with a core_size larger than the actual packet length, causing unauthorized memory reads.

A double-free vulnerability in the NVIDIA NVDEC hardware decoder in FFmpeg versions 4.4 through 8.1.2. Attackers can trigger memory corruption by supplying a crafted video file, causing a double-free of the decoder context.

Duplicati v2.3.0.1 grants Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing outside Program Files or on a custom path creates a LocalSystem service running from a writable directory. A standard local user can overwrite any DLL in the service directory, leading to arbitrary code execution as SYSTEM on service restart.

Onlook up to version 0.2.32 contains a Broken Object Level Authorization (BOLA) vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values in tRPC API procedures. Attackers can read, modify, and delete other users' projects, members, and conversation history.

In FFmpeg versions 8.0 through 8.1.2, a stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder. A remote attacker can supply a crafted HEVC/H.265 bitstream with a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, causing overflow of stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability in the VobSub subtitle demuxer. Supplying a malicious .sub/.idx file with excessive stream IDs can cause out-of-bounds writes and potential code execution.

Vulnerability in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) in the IAM component generates incorrect security tokens. A low-privileged remote attacker can escalate privileges.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability. A high privileged attacker with remote access could exploit this to achieve privilege escalation.