CVE Vulnerability Catalog

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Resource allocation without limits or throttling in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

A protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

An incorrect authorization vulnerability has been discovered in .NET that allows an unauthorized attacker to bypass a security feature over a network.

Stack-based buffer overflow in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

The .NET platform does not limit resource allocation, allowing an unauthorized attacker to perform a denial-of-service attack over a network.

Improper input type validation in .NET Framework allows an unauthorized attacker to cause a remote denial of service (DoS).

A vulnerability in Symfony affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS by omitting IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6). This allows attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block.

A vulnerability in Symfony allows an unauthenticated attacker, via a failed login request with a _failure_path parameter, to dispatch a subrequest to protected GET routes while bypassing firewall listeners. This occurs when failure_forward: true is enabled.

A Path Traversal vulnerability in Animate could lead to arbitrary code execution in the context of the current user. An attacker can exploit this to access sensitive files or directories outside intended restrictions. Exploitation requires user interaction, as a victim must open a malicious file.

An Incorrect Authorization vulnerability in Animate could allow arbitrary code execution in the context of the current user. Exploitation does not require user interaction but depends on conditions beyond the attacker's control. The scope of the vulnerability has changed.

An Incorrect Authorization vulnerability in Animate could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file) and depends on conditions beyond the attacker's control. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

Adobe Experience Manager is affected by a Path Traversal vulnerability that allows unauthorized file system read outside the intended scope. An attacker can exploit this to access sensitive files and directories without user interaction.

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation does not require user interaction and the scope is changed.

A vulnerability in the @grpc/grpc-js library allows an attacker to send an invalid compressed message, causing a crash of the client or server process. The issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

A vulnerability in the @grpc/grpc-js library allows remote crash of the server by sending an invalid HTTP/2 stream initiation request. Affected versions are prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.