CVE Vulnerability Catalog

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.

A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write" by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

AMI APTIOV contains a BIOS vulnerability that allows a local user to trigger a classic buffer overflow. Successful exploitation could lead to buffer overflows, memory corruption, and arbitrary code execution.

AMI APTIOV contains a BIOS vulnerability that allows a local user to trigger an integer overflow or wraparound. Successful exploitation could lead to buffer overflows, memory corruption, and arbitrary code execution.

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading that allows an attacker to cause RCE by convincing a user to load a maliciously crafted file. Successful exploitation may lead to code execution, privilege escalation, information disclosure, and data tampering.

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API that allows an unauthenticated remote attacker to access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. Successful exploitation may lead to information disclosure and unauthorized start or stop operations.

NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend that allows an unauthenticated remote attacker to cause server-side request forgery by supplying a crafted original URL. Successful exploitation may lead to information disclosure.

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component that allows a remote attacker to bypass pathname restrictions by supplying crafted archive member names to a dSort job. Successful exploitation may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.

NVIDIA AIStore for Linux contains a vulnerability in the Promote API that allows an unauthenticated remote attacker to read files accessible to the target process by supplying a crafted absolute source path. Successful exploitation may lead to information disclosure.

NVIDIA DALI contains a vulnerability that allows an attacker to cause an uncontrolled out-of-bounds read. Successful exploitation may lead to information disclosure, data tampering, and denial of service.

NVIDIA DALI contains a vulnerability that allows an attacker to cause an uncontrolled out-of-bounds write. Successful exploitation may lead to denial of service, information disclosure, and data tampering.

NVIDIA DALI contains a vulnerability that allows an attacker to cause a stack-based buffer overflow. Successful exploitation may lead to code execution, information disclosure, data tampering, and denial of service.

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.

NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.