CVE Vulnerability Catalog

OpenCV through version 3.3 has a denial of service issue related to memory consumption, as demonstrated by the 10-opencv-dos-memory-exhaust test case.

OpenCV through version 3.3 has a buffer overflow in the cv::BmpDecoder::readData function that can occur when reading an image file using cv::imread. This issue is demonstrated by the 4-buf-overflow-readData-memcpy test case.

OpenCV versions up to 3.3 have a denial of service issue leading to excessive CPU consumption. This issue is demonstrated by the 11-opencv-dos-cpu-exhaust test case.

OpenCV through version 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file using cv::imread.

OpenCV through version 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function when reading an image file using cv::imread. This issue is demonstrated by the 8-opencv-invalid-read-fread test case.

OpenCV through version 3.3 has an out-of-bounds write error in the FillColorRow1 function in utils.cpp when reading an image file using cv::imread.

In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.

A Cross-Site Request Forgery (CSRF) vulnerability exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP.

ImageMagick version 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.

The Sandboxie installer version 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability that can be exploited by a malicious dwmapi.dll or profapi.dll file in the AppData\Local\Temp directory.

SLiMS 8 Akasia versions up to 8.3.1 have SQL injection vulnerabilities in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

SLiMS 8 Akasia through version 8.3.1 lacks CSRF protections. This allows remote attackers to trick a user into changing to an attacker-controlled password, leading to complete account takeover.

A vulnerability in GitHub Electron before version 1.6.8 allows remote command execution due to a nodeIntegration bypass. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier.

Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer by sending a large amount of HTTP packets.

An issue was discovered in SMA Solar Technology products that allows an attacker to change the system time without any authentication. This can affect lockout policies and random-number generators based on timestamps.

An issue was discovered in SMA Solar Technology products that allows for cross-site request forgery when a user runs Sunny Explorer and visits a malicious host. An attacker can change inverter settings, including user passwords.

An issue was discovered in SMA Solar Technology products that allows the creation of a debug report when signed into Sunny Explorer with a wrong password. This enables an attacker to disclose information regarding the application and save a .txt file with arbitrary content.

An issue was discovered in SMA Solar Technology products that allows determining active and inactive user accounts by sending crafted packets to an inverter and observing the response. This aids in further attacks, such as brute force attacks, as the attacker gains knowledge of existing users.

An issue was discovered in SMA Solar Technology products related to the SMAdata2+ communication protocol, which does not properly use authentication with encryption. It is vulnerable to man in the middle, packet injection, and replay attacks.

An issue was discovered in SMA Solar Technology products that can lead to a crash of the Sunny Explorer application. By sending nonsense data or setting up a TELNET session to the database port, the application can be crashed.