CVE Vulnerability Catalog

Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

The Endpoint Manager module in FreePBX contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. This parameter allows an attacker to change the file path, potentially leading to webshell upload. Authentication with a known username is required.

The Endpoint Manager module in FreePBX contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration areas. Authentication with a known username is required.

FreePBX, an open-source GUI for managing Asterisk, has a reflected cross-site scripting vulnerability on the Asterisk HTTP Status page. Affected versions are prior to 16.0.68.39 for FreePBX 16 and prior to 17.0.18.38 for FreePBX 17. The status page is exposed by default on port 8088 on all bound IPs in version 16, and only on localhost in version 17. Unauthenticated attackers can exploit this to obtain cookies from logged-in users, allowing session hijacking of an administrative user and full control over the FreePBX admin interface.

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required.

An out-of-bounds write vulnerability in Illustrator versions 29.7, 28.7.9 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

An out-of-bounds write vulnerability in Illustrator versions 29.7, 28.7.9 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Substance3D - Modeler versions 1.22.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Flowise versions 3.0.1 to 3.0.8 and all later versions with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and Node VM sandbox escape. An authenticated attacker can use integrated Puppeteer and Playwright modules to execute arbitrary binaries on the host.

An out-of-bounds write vulnerability in Substance3D - Viewer versions 0.25.2 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to crash the application or make it unavailable. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Viewer versions 0.25.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

An out-of-bounds write vulnerability in Substance3D - Viewer versions 0.25.2 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

NVIDIA Jetson Linux zawiera podatność w UEFI, gdzie niewłaściwa autoryzacja może pozwolić uprzywilejowanemu użytkownikowi na uszkodzenie drzewa urządzeń Linux. Skuteczne wykorzystanie tej podatności może prowadzić do manipulacji danymi oraz odmowy usługi.

Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.

Problem w interfejsie Konfiguracji Nowego Klastra w kafka-ui w wersjach od 0.6.0 do 0.7.2 umożliwia atakującym spowodowanie odmowy usługi (DoS) poprzez przesłanie spreparowanego pliku konfiguracyjnego.

Podatność typu path traversal w FastX3 do wersji 3.3.67 pozwala nieautoryzowanemu atakującemu na odczyt dowolnych plików na serwerze. Wykorzystując tę podatność, można uzyskać dostęp do plików konfiguracyjnych aplikacji, które zawierają klucz tajny używany do podpisywania tokenów JWT oraz istniejące JTI.

NVIDIA Isaac Lab zawiera podatność w analizie konfiguracji SB3. Skuteczne wykorzystanie tej podatności może prowadzić do wykonania kodu, odmowy usługi, eskalacji uprawnień, ujawnienia informacji lub manipulacji danymi.