CVE Vulnerability Catalog

SumatraPDF 3.6.1 and earlier has a vulnerability in InitializePolicies() where the sumatrapdfrestrict.ini path starts with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying with this INI file, including malformed or zero-valued settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions.

SumatraPDF 3.5.2 and earlier substitutes an attacker-controlled SyncTeX source filename for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags.

SumatraPDF 3.6.1 and earlier has a vulnerability in FrameOnCommand() where CmdExec passes a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state.

SumatraPDF 3.6.1 and earlier interpolates untrusted document paths and PDF link targets into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context.

SumatraPDF 3.7.0.22298 has four independently reachable range-validation variants in src/LitDoc.cpp that allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. Opening a crafted LIT file can cause invalid pointer reads and deterministic application termination.

SumatraPDF 3.7.0.22298 has a vulnerability in LitParseHeader() in src/LitDoc.cpp where the attacker-controlled hdrLen + nPieces * 16 section offset is computed using signed 32-bit arithmetic without validating the complete result. When the aggregate calculation overflows to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination.

SumatraPDF 3.7.0.22298 has a vulnerability in src/MobiDoc.cpp where the untrusted unsigned mobiHdr.hdrLen field is narrowed to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation.

Strawberry GraphQL from 0.217.0 until 0.326.1 has a vulnerability where PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false.

Strawberry GraphQL versions 0.312.3 through 0.327.2 do not remove completed operations from task and subscription lists in the legacy graphql-ws handler. With a configured per-connection subscription limit, a client can exhaust the limit, blocking later legitimate operations. Fixed in version 0.327.2.

A heap-based buffer overflow was found in Eye of GNOME (eog) in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could entice a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without valid user credentials.

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon.

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authentication.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 store sensitive information in cleartext in logs. A local attacker can access this data.

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to the use of hard-coded credentials.

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

IBM Guardium Data Protection 12.2 and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for a critical function.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.