CVE Vulnerability Catalog

Integer overflow vulnerability in Samsung's rlottie library allows integer attacks. The issue affects versions before commit 21292665023e5074b38254432716866d00f1985f.

Access of uninitialized pointer and uncontrolled recursion vulnerability in Samsung's rlottie library allows pointer manipulation and oversized serialized data payloads. The issue affects versions before commit eae37633fda13ac05b25c6c95aacea4bc33c80a3.

Memory allocation with excessive size value vulnerability in Samsung's rlottie library allows excessive allocation. The issue affects versions before commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

In the Samsung Open Source rlottie library before commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035, there is a stack-based buffer overflow vulnerability allowing buffer overflows.

Uncontrolled recursion vulnerability in Samsung's rlottie library allows oversized serialized data payloads. The issue affects versions before commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

Out-of-bounds read vulnerability in Samsung's rlottie library allows buffer overread. The issue affects versions before commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

Weak validation logic in device dissociation API routines allows a remote attacker to forcefully unbind unrelated user endpoints, causing severe denial of service.

A vulnerability in incoming VPN network profile processing. Unsafe handling of special characters allows command injection via malicious config files.

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur.

A vulnerability in NetworkManager allows local privilege escalation through processing malformed MUD URLs in the dhclient backend. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

OpenStack Ironic before version 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

OMICARD EDM by ITPison has an Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink software before 2.11.12. An unauthenticated attacker within radio range can disclose a small amount of kernel heap memory or cause DoS (kernel oops/panic) via a crafted 802.11ah beacon or probe response with a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate IE length, leading to an out-of-bounds read of up to 9 bytes. No authentication or user interaction required.

The Perl library Net::Async::Statsd::Client up to version 0.005 does not validate metric names for newlines, colons or pipes. This allows injection of additional statsd metrics when data comes from untrusted sources.

OpenStack Ironic before 35.0.2 allows iPXE script injection if the attacker can set node.driver_info or node.instance_info.

FOSSBilling before 0.8.0 has an open redirect vulnerability in the Redirect module. The module does not validate the URL scheme of administrator-configured destination URLs, allowing arbitrary external URLs as redirect targets.