CVE Vulnerability Catalog

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

An issue in the Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 (commit 2d08d0d8b4563212175212f9db0e69f6e68c9619) allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, and CSRFile logic.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to script injection.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an improper privilege management vulnerability. A high-privileged attacker with remote access could exploit it to elevate privileges.

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the crafted directory name is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1, producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer. Only version 5.2 was tested and confirmed as vulnerable.

nnn is vulnerable to an out-of-bounds write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious session file in the victim's nnn session directory can exploit this to corrupt adjacent global state. Only version 5.2 was tested and confirmed as vulnerable.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to script injection.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS command injection vulnerability. A high-privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS command injection vulnerability. A low-privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise versions prior to 4.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could exploit it, leading to information exposure.

An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than comparing the full data. This allows an attacker with physical write access to boot media to forge modified SPL images that pass secure boot verification without the OEM signing key. Each forgery attempt succeeds with approximately 2/3 probability.