CVE Vulnerability Catalog

A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used.

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used.

A security vulnerability was detected in Matthias-Wandel jhead up to 3.3. It affects the ProcessGpsInfo function in gpsinfo.c of the WebP EXIF Handler component. Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments leads to a heap-based buffer overflow. The attack requires local access and the exploit has been publicly disclosed.

A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. This may allow uploading dangerous files.

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. This issue exists because of an incorrect fix for CVE-2022-23491.

An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.

An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.

A bodyclass XSS issue was discovered in Paessler PRTG before version 23.3.86.1520. The vulnerability allows injection of malicious script into the application interface.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.

An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save states.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. This vulnerability could be exploited by an attacker to cause a crash or potentially execute code.

A stack-based buffer overflow vulnerability was discovered in D-Link DIR-823G version 1.0.2B05_20181207, in the strcpy function of /HNAP1/SetStaticRouteSettings (HNAP1 component). Manipulating the PAddress/SubnetMask/Gateway arguments triggers the overflow. The attack can be launched remotely.

A weakness has been identified in cochise up to 0.4.1, affecting the asyncssh.connect function in src/cochise/ssh_connection.py related to SSH Host Key Handler. Manipulation can lead to improper certificate validation. The attack may be launched remotely, requires high complexity, and is difficult to exploit, but the exploit is publicly available.

A security flaw has been discovered in GNU libredwg 0.13.4, impacting the DWG_TABLE function in src/dwg.spec related to Layer Encoding. Manipulation results in null pointer dereference. The attack requires local access, and the exploit is publicly available. Upgrading to version 0.14 fixes the issue.

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. It affects the ssh_run_command function in src/hackingBuddyGPT/extensions/ssh_run_command.py and leads to OS command injection. The attack can be launched remotely and the exploit is publicly available.