CVE Vulnerability Catalog

Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a remote denial of service via an out-of-bounds memory read during processing of a document file by the antivirus engine.

A vulnerability has been found in GPAC up to f1219cde in the function lsr_exec_command_list of the file laser/lsr_dec.c of the MP4Box component. The manipulation leads to a reachable assertion, and local access is required to exploit it.

An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (including Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123). In the Shannon SM Task, improper handling of a loop with an unreachable exit condition cannot guarantee termination of a required service via a malformed SM message.

An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.

A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used.

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used.

A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.

An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save states.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. This vulnerability could be exploited by an attacker to cause a crash or potentially execute code.

A weakness has been identified in cochise up to 0.4.1, affecting the asyncssh.connect function in src/cochise/ssh_connection.py related to SSH Host Key Handler. Manipulation can lead to improper certificate validation. The attack may be launched remotely, requires high complexity, and is difficult to exploit, but the exploit is publicly available.

A security flaw has been discovered in GNU libredwg 0.13.4, impacting the DWG_TABLE function in src/dwg.spec related to Layer Encoding. Manipulation results in null pointer dereference. The attack requires local access, and the exploit is publicly available. Upgrading to version 0.14 fixes the issue.

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a crafted save file.

An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses an insecure timing comparison that leads to an attacker being able to bruteforce the admin password by measuring timing differences in the comparison.

An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using an open redirect vulnerability.