CVE Vulnerability Catalog

A cross-site request forgery vulnerability exists in Musetheque V4 for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged in, unexpected operations may occur.

A vulnerability in Zen 2-based processors arises from improper isolation of shared resources within the CPU operation cache. This allows an attacker to corrupt instructions executed at a different privilege level, potentially leading to privilege escalation.

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevated privileges potentially leading to arbitrary code execution.

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register space of the JPEG cores assigned a victim VM/process, potentially gaining arbitrary read/write access to the victim VM/process data.

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. An attacker can exploit an OpenSSL configuration file to trick the high-privilege service into executing arbitrary commands.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled. Issues with the authentication mechanisms lead to a bypass of protections on routes such as the Job API and the OpenTelemetry trace ingestion API.

An out of bounds write in the AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.

Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting integrity and availability, or allowing privilege escalation resulting in loss of confidentiality.

An out of bounds write within the AMD Platform Management Framework (PMF) could allow an attacker to execute arbitrary code at an elevated privilege level potentially leading to loss of confidentiality integrity, or availability.

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.

Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution.

Improper restriction of operations within the bounds of a memory buffer in the AMD secure processor (ASP) could allow an attacker to read or write to protected memory potentially resulting in arbitrary code execution.

Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker with the ability to write outside the trusted memory range (TMR) to change the execution flow of the Video Core Next (VCN) firmware.

Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

CVE-2025-52540 describes an improper input validation vulnerability in the AMD Platform Management Framework (PMF) Driver that can allow a local attacker to write Out-of-Bounds, potentially resulting in privilege escalation.

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or write Out-of-Bounds, potentially resulting in privilege escalation.

Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

In ZITADEL, an identity management platform, a vulnerability was discovered in the LDAP identity provider implementation that improperly handles user-provided usernames in LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process.