CVE Vulnerability Catalog

A heap-based buffer overflow in the diff3 tool from GNU diffutils due to multiple signed integer overflows in line-mapping calculations. An attacker controlling diff3 input (e.g., via --diff-program) can trigger out-of-bounds writes, leading to a crash or potentially remote code execution.

In Unbound from 1.6.2 up to 1.25.1, when configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. An attacker can exploit this by spoofing BOGUS A/AAAA answers.

In NLnet Labs Unbound from 1.6.0 to 1.25.1, a wildcard RRset replay can be temporarily considered DNSSEC-secure based on RRSIG validation and cached. Later NSEC validation marks it as bogus, but another thread may use it for a reply, replacing a specific record with a wildcard. The attack requires a DNSSEC-signed domain and a CNAME record pointing to a sibling record of a wildcard.

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, an off-by-one error in the 'harden-below-nxdomain' logic allows stub or forward zones below a DNSSEC signed zone to be shadowed by a secure NXDOMAIN answer from the parent, bypassing the configuration.

Unbound DNS server versions 1.16.2 through 1.25.1 are vulnerable to a 'ghost domain names' attack, allowing an adversary controlling a ghost zone to extend the ghost domain window by one configured TTL for A/AAAA glue records. With 'harden-referral-path: yes', no client query is needed.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly, inflating the number of waiting replies for in-flight queries and causing degradation of resolution service for new clients.

The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.

Signed integer overflow vulnerability in libarchive's ZIP writer in archive_write_zip_header. When ZIP encryption is enabled and file size is near INT64_MAX, adding encryption overhead overflows int64_t, causing undefined behavior, potentially incorrect Zip64 decisions or memory corruption.

Google Chrome prior to version 150.0.7871.182 has an uninitialized use vulnerability in Skia. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.

Vulnerability in Oracle Time and Labor (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may cause partial denial of service.

Vulnerability in Oracle EDI Gateway (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, requires high-privileged attacker with local logon, allows unauthorized read access to a subset of data.

Vulnerability in Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll) in versions 12.2.3-12.2.15. A difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle HRMS (UK) data. CVSS 3.1 Base Score 2.2 (Confidentiality impact).

Vulnerability in Oracle Agile Engineering Data Management (version 6.2.1) allows a low-privileged attacker with user interaction to cause a partial denial of service.

Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.

Vulnerability in MySQL Server and MySQL Cluster (component: Server: Pluggable Auth) in specified versions. Difficult to exploit, unauthenticated attacker with local logon can modify data.

A vulnerability in MySQL Server and MySQL Cluster (Performance Schema component) allows an authenticated attacker with high privileges to unauthorizedly read a subset of data. The attack requires network access and is easy to exploit.

In Oracle PeopleSoft Enterprise FIN Engineering Argentina (version 9.1), a vulnerability in the Engineering component allows a high-privileged attacker with network access via HTTP to gain unauthorized read and update access to some data.

Vulnerability in Oracle Inventory Optimization (Oracle E-Business Suite) versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to cause a partial denial of service (partial DOS).

Vulnerability in Oracle Production Scheduling (versions 12.2.3-12.2.15) allows a high-privileged attacker with local logon to modify data.

Vulnerability in Oracle HRMS (Norway) versions 12.2.3-12.2.15. Easily exploitable by an authenticated attacker with high privileges, allowing unauthorized update, insert, delete, and read access to payroll data.