CVE Vulnerability Catalog

The vulnerability in FreeRDP affects clients and involves an integer underflow leading to a Denial of Service (DOS). The issue occurs when an insufficient block length is provided, and proper length validation is not performed.

Podatność CVE-2022-46869 dotyczy lokalnego podwyższenia uprawnień podczas instalacji z powodu niewłaściwego zarządzania dowiązaniami symbolicznymi. Dotyczy to produktów Acronis Cyber Protect Home Office (Windows) przed wersją 40278 oraz Acronis True Image OEM (Windows) przed wersją 42575.

FreeRDP has a Global-Buffer-Overflow vulnerability in the ncrush_decompress function, which can be triggered by crafted input. This issue causes application crashes and has been addressed in versions 2.11.0 and 3.0.0-beta3.

There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.

CVE-2023-41747 involves sensitive information disclosure due to unauthenticated path traversal. The affected products are Acronis Cloud Manager (Windows) before build 6.2.23089.203.

There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.

CVE-2023-41745 vulnerability involves sensitive information disclosure due to excessive collection of system information. The affected products are Acronis Agent (Linux, macOS, Windows) before build 30991 and Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.

Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.

Eclipse Leshan, a device management server, is vulnerable to XXE attacks in versions containing `DDFFileParser` and `DefaultDDFFileValidator`. Users are only at risk if they parse untrusted DDF files.

There is a NULL pointer dereference bug in the GitHub repository gpac/gpac prior to version 2.3-DEV.

Heap-based buffer overflow exists in the GitHub repository gpac/gpac prior to version 2.3-DEV.

There is a NULL Pointer Dereference vulnerability in the GitHub repository gpac/gpac prior to version 2.3-DEV.

There is a divide by zero error in the GitHub repository gpac/gpac prior to version 2.3-DEV.

CVE-2023-41744 allows local privilege escalation due to unrestricted loading of unsigned libraries. The affected products are Acronis Agent (macOS) before build 30600 and Acronis Cyber Protect 15 (macOS) before build 35979.

CVE-2023-41743 allows local privilege escalation due to insecure driver communication port permissions. It affects several Acronis products, including Acronis Cyber Protect Home Office and Acronis True Image OEM.

Versions 3.6.1.25 and prior of Zscaler Proxy have inappropriate file type control, allowing local attackers to bypass file download/upload restrictions.

The CVE-2023-34392 vulnerability in the SEL-5037 SEL Grid Configurator allows an attacker to execute arbitrary commands on managed devices by an authorized device operator due to missing authentication for critical functions.

CVE-2023-34391 involves an insecure inherited permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows, allowing manipulation of configuration file search paths.

CVE-2023-41742 vulnerability concerns excessive attack surface due to binding to an unrestricted IP address. Affected products include Acronis Agent (Linux, macOS, Windows) before build 30430 and Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.