CVE Vulnerability Catalog

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data.

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data.

In libsmpp35 from 0.1.0 through 1.8.0, an out-of-bounds read issue was found in the smpp34_unpack() function via attacker-controlled SMPP PDUs, leading to memory corruption.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition().

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name.

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and wsmp.loop_length values to samples without calling fluid_sample_validate() or fluid_sample_sanitize_loop(). A crafted DLS file can place sample loop points beyond the sample buffer, causing out-of-bounds reads during audio rendering.

FluidSynth from 2.2.4 to 2.5.6 contains a vulnerability related to configuring synth.midi-channels above 16, allowing out-of-bounds reads and writes in the _fluid_player_t::channel_isplaying structure. This can lead to undefined behavior and compromise confidentiality, integrity, or availability. The issue is fixed in version 2.5.6.

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40, C client, could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to read files outside the intended tutorial directory.

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on update and delete operations. Due to a parameter naming error, authorization does not check the lease owner, allowing any authenticated user to modify or delete leases belonging to other users.

In OpenStack Blazar before 17.0.1, the V2 lease listing operation returns leases for every project without enforcing project scoping or administrator-only policy. Any authenticated user can enumerate leases of other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata.

In osmo-iuh from 0.1.0 through 1.8.0, a reachable assertion was found in the ranap_handle_co_dt() function via an arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.

In osmo-bsc from 1.0.1 through 1.14.1, a heap-based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths. This can lead to memory corruption.