CVE Vulnerability Catalog

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. An attacker can leverage this to execute arbitrary code in the context of the current process.

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. An attacker may leverage this to cause a crash, data corruption, or arbitrary code execution in the context of the current process.

A maliciously crafted SVG file parsed through Autodesk 3ds Max can cause an Out-of-Bounds Read vulnerability, allowing a crash, sensitive data read, or arbitrary code execution in the current process context.

A maliciously crafted SVG file parsed through Autodesk 3ds Max can trigger uncontrolled recursion. An attacker may exploit this to cause the application to terminate unexpectedly, resulting in denial of service.

A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter.

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.

RansomLook created its Flask session-signing key without restricting file permissions, resulting in permissions like 0644. Other local users can read the cryptographic secret, allowing them to generate valid session cookies and impersonate authenticated users, including administrators.

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. The issue stems from timing differences for existing vs. non-existing usernames and lack of rate limiting on failed login attempts.

A vulnerability was found in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. The handleToolCall function in src/tools/handlers.ts of the Tool Handler component allows OS command injection via the format argument. Local access is required, and the exploit is public.

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.

Netty prior to versions 4.1.137.Final and 4.2.17.Final has a vulnerability in MqttEncoder that does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields. This can cause routing, access-control, or identity mismatches in downstream brokers.

Mistune versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from asterisks, and recursive rendering can exceed Python's recursion limit, causing a crash. Fixed in version 3.3.3.

joserfc, a Python library implementing JOSE standards, prior to version 1.7.3, has a vulnerability in JWTClaimsRegistry that applies membership matching to list-valued iss and sub claims, allowing an array-valued iss containing the expected issuer to pass an intended equality check and enabling issuer-validation bypass.

An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software allows attackers to cause a Denial of Service (DoS) via a crafted CAN message.

A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software allows attackers to cause a Denial of Service (DoS) via a crafted ECSS TC message.

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. This causes a disagreement between views: Test Universe Checking reports the check as enabled while the kernel continues to accept universe-inconsistent terms. This allows Hurkens' paradox to be applied, yielding a proof of False. No fix is available.

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvar call that the definition and theorem paths perform. A metaprogram can exploit this to accept an opaque declaration with a free variable, leading to an opaque constant of type False and proving any proposition. Fixed in 4.32.2.

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. This admits a type that is definitionally equal to its own negation, so self-application produces False. Fixed in Rocq 9.2.0.

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which is accepted but alters the recursive tree. A second fixpoint inherits the altered tree without verification, allowing a non-structurally decreasing call to be accepted. This leads to a non-terminating definition and a proof of False. A fix is proposed but not merged.