CVE Vulnerability Catalog

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying operating system and gain root-level access.

CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.

Bransys ELD is shipped with hardcoded MQTT credentials. These credentials grant read access to real-time data for every active device across a subset of carriers connected to the affected MQTT broker.

A buffer overflow flaw was found in pppd's PEAP response handling. A remote attacker could send a specially crafted PEAP Request packet to corrupt global static data in the pppd process.

In OpenImageIO prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a truncated TGA can leave a pending GIF frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the GIF palette.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted PSD with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, an indexed PSD with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. When oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, an uncompressed 16-bit IFF image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. The oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted Cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted FITS stream containing consecutive 2880-byte header blocks without the mandatory END keyword makes fitsinput::read_fits_header() call itself without a depth bound. Repeated recursive parsing exhausts the application stack.

In http4k prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefore receive weaker MD5-based verification.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM WebSphere Application Server (versions 9.0 and 8.5) could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) transmits data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.