CVE Vulnerability Catalog

FreeRDP before version 3.20.1 contains a use-after-free vulnerability in the irp_thread_func function. The IRP object is freed by irp->Complete() and then accessed again on the error path, potentially leading to memory corruption.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.

In FreeRDP prior to 3.20.1, a heap out-of-bounds read vulnerability exists in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length.

FreeRDP before version 3.20.1 contains a heap-buffer-overflow vulnerability in drive read. A server-controlled read length is used without a hard upper bound, allowing an oversized read to overwrite heap memory.

In FreeRDP prior to version 3.20.1, a vulnerability exists due to missing bounds checking on the element count in the NDR array reader of the RDPEAR protocol. An attacker can exploit this to write beyond the allocated heap buffer, causing a heap buffer overflow in the ndr_read_uint8Array function.

FreeRDP before version 3.20.1 contains a heap-buffer-overflow write vulnerability when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple PDUs and writes past the newly allocated array, causing memory corruption and a crash.

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to execute arbitrary commands with root privileges if the file /opt/images/public_key.der is missing. The vulnerability is triggered by providing a maliciously crafted auth.ini file on the device's SD card.

Cursor to edytor kodu stworzony do programowania z wykorzystaniem AI. Przed wersją 2.3, gdy Agent Cursor działał w trybie Auto-Run z włączonym trybem Allowlist, niektóre wbudowane polecenia powłoki mogły być wykonywane bez pojawiania się na liście dozwolonych i bez wymagania zgody użytkownika.

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

FreeImage 3.18.0 contains a Use After Free vulnerability in PluginTARGA.cpp in the loadRLE() function. Memory is freed and then accessed again, potentially leading to undefined behavior.

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

W usłudze Orchestrator występuje podatność, która może pozwolić nieautoryzowanemu zdalnemu atakującemu na ominięcie wymagań dotyczących uwierzytelniania wieloskładnikowego. Udana eksploitacja może umożliwić atakującemu utworzenie konta użytkownika z uprawnieniami administratora bez konieczności przechodzenia przez uwierzytelnianie wieloskładnikowe.

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.

A global buffer overflow vulnerability in TinyOS up to version 2.1.2 exists in the printfUART formatted output implementation used in the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s specifiers using strcat() without checking remaining capacity, causing writes past the end of debugbuf.

A vulnerability in the AIRTH SMART HOME AQI MONITOR Bootloader v1.005 allows a physically proximate attacker to obtain sensitive information via the open UART port of the BK7231N controller (Wi-Fi and BLE module).

A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.