CVE Vulnerability Catalog

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bounds write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with permissions to insert eBPF code can leak internal kernel memory details, defeating some exploit mitigations. Affects kernel versions < v5.16-rc6.

NULL pointer dereference vulnerability in the GitHub repository gpac/gpac prior to 1.1.0. It may cause an application crash when processing crafted data.

In InsydeH2O Kernel 5.0 through 5.4 before specific versions, a stack-based buffer overflow in the UEFI DisplayTypeDxe DXE driver can lead to arbitrary code execution.

Reflected XSS vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. Attacker-controlled input is reflected back in the page without sanitization.

SQL Injection vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to inject malicious SQL code, potentially gaining unauthorized access to additional audit records.

A reflected XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

A potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. The vulnerability could be exploited by an attacker to delete files on the victim's system.

The Apache Xerces Java (XercesJ) XML parser in version 2.12.1 and earlier is vulnerable to an infinite loop when handling specially crafted XML document payloads. This may cause the parser to wait indefinitely, potentially consuming system resources for a prolonged duration.

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability allows leakage of data that should be restricted.

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

vim is vulnerable to a heap-based buffer overflow. Technical details are not provided in the description.

Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.

W wersji 1.4.0 Trusted Firmware-M (TF-M) przy użyciu profilu Small występuje nieprawidłowa kontrola dostępu. NSPE może uzyskać dostęp do zabezpieczonego klucza (przechowywanego przez usługę Crypto) jedynie na podstawie znajomości jego identyfikatora klucza.