CVE Vulnerability Catalog

Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.

Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A vulnerability in Quinn before version 0.11.14 allows a remote, unauthenticated attacker to trigger a denial of service (DoS) by sending a crafted QUIC Initial packet with malformed transport parameters. The flaw is due to the use of unwrap() when decoding varints, causing a panic on truncated encoding.

An Improper Certificate Validation vulnerability in Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier could result in a Security feature bypass. An attacker could leverage this to spoof the identity of a signer. Exploitation requires user interaction.

Craft CMS before versions 4.17.3 and 5.9.7 has a CSRF issue in the preview token endpoint at /actions/preview/create-token. An attacker can force a logged-in editor to mint a preview token, which can then be used to access unpublished content.

Giflib contains a double-free vulnerability resulting from a shallow copy in GifMakeSavedImage and improper error handling. The conditions to trigger this vulnerability are difficult but possible.

DNG SDK versions 1.7.1 2471 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to its availability. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting its availability. Exploitation requires user interaction – the victim must open a malicious file.

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting services. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting services. Exploitation requires user interaction – the victim must open a malicious file.

A NULL Pointer Dereference vulnerability in Substance3D Painter versions 11.1.2 and earlier could lead to application denial-of-service. An attacker could exploit this to crash the application, disrupting services. Exploitation requires user interaction – the victim must open a malicious file.

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.

A deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity, and potential remote code execution on a workstation when an admin authenticated user opens a malicious project file.

A Cross-site Scripting (CWE-79) vulnerability exists that allows authenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim hovers over a maliciously crafted element on a web server containing the injected payload.