CVE Vulnerability Catalog

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepting replayed application-layer payloads injected into an active TCP session.

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed SYN packets.

A vulnerability in openRISC OR1200 (commit 83ac6b) is due to an inaccurate update of program counter (PC) values when SPR changes, which can lead to a Denial of Service (DoS).

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this, leading to unauthorized access.

In the Dia diagram editor, there is a heap-based buffer overflow vulnerability in the WPG file format importer. The WPG import renderer allocates a fixed palette of 256 entries. When handling a WPG_COLORMAP record, the parser reads a start index and number of colors without validating bounds. A malicious WPG file can cause an out-of-bounds write, leading to a crash or potentially arbitrary code execution.

Dell PowerProtect One, versions 20.1.0.0 and below, contain an OS Command Injection vulnerability. A low privileged attacker with remote access could potentially exploit this, leading to code execution.

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this, leading to denial of service.

Dell PowerProtect One, versions 20.1.0.0 and below, contain an OS Command Injection vulnerability. A low privileged attacker with remote access could potentially exploit this, leading to remote code execution.

Frappe is a full-stack web application framework. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes they are not authorized to access. When a document references another via a Link field, the framework does not consistently enforce the linked DocType's permissions, so a low-privileged user can obtain fields from linked records outside their scope. Fixed in 15.115.0.

Fleet is an open-source device management platform. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value used in a database query without proper parameterization, allowing an attacker controlling one enrolled host to read or modify arbitrary data in the Fleet database. By disclosing arbitrary database contents, an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution.

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.

In Stomper 5e2741e, when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or access to invalid memory) while processing the frame, causing the process to crash.

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closing the socket at specific points.

stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages.

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint.