CVE Vulnerability Catalog

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

A security flaw has been discovered in PowerISO 9.3.0.0, affecting some unknown functionality in the scdemu.sys library of the Kernel Driver component. The manipulation results in improper privilege management. The attack requires local access, and the exploit has been released. The vendor did not respond.

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.

Out-of-Bounds Write vulnerability when parsing a malicious PDF in Autodesk Revit. Can cause crash, data corruption, or arbitrary code execution.

Vulnerability in udisks2 allows a local attacker with an active console session to exploit insufficient authorization on the 'as-user' option in the Mount() D-Bus method. This allows spoofing and mounting filesystems on behalf of other users, leading to privilege escalation.

Untrusted Pointer Dereference vulnerability when parsing a malicious BMP file in certain Autodesk products. Could allow arbitrary code execution.

Vulnerability in the PHP library league/commonmark (versions 0.6.0 to 2.9.0) causes quadratic time complexity when parsing specially crafted Markdown lines. An attacker can submit a small request that consumes disproportionate CPU time.

Vulnerability in Nx (versions 20.8.0 to 22.7.7 and 23.0.2) in the self-hosted HTTP remote cache. A malicious cache server can return a crafted tar archive that writes files outside the cache directory, potentially leading to remote code execution.

Reflected XSS vulnerability in AIL Framework at the /tag/add_tags endpoint. The error value is returned without proper encoding, allowing arbitrary HTML or JavaScript execution in the victim's browser.

Vulnerability in Traefik (versions 3.0.0 to 3.6.25 and 3.7.10) in the Kubernetes Gateway API provider. Router and service identity construction can cause collisions, allowing overwriting another namespace's backend.

Vulnerability in Traefik (before 2.11.53, 3.6.24, and 3.7.9) in the default HTTP reverse proxy. Forwarding CONNECT requests can lead to connection desynchronization, allowing an attacker to smuggle responses to another client.

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer and achieve remote code execution.

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution.

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation and potentially disrupting dependent OAuth integrations.

TimescaleDB through 2.29.1 contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery.

TimescaleDB through 2.29.1 contains an out-of-bounds read in the Dictionary compression reverse row iterator, where the reverse path does not validate the Simple8b index, allowing attackers with DML access to a physical compressed relation to disclose backend memory including the shared buffer pool as a normal column value. Attackers can store a crafted datum and run a reverse-order scan, leading to memory disclosure that SQL access control does not cover.