CVE Vulnerability Catalog

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file.

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing heap over-reads, title corruption, or client crashes.

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client. A malicious RDP server can request unadvertised camera media types by sending a StartStreamsRequest with oversized dimensions, forcing large allocations and reconfiguring the local camera via the HAL.

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport. A malicious gateway can send zero-length pings, causing a nullptr stream to be passed to websocket_reply_close and crashing the client.

Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 contains a vulnerability in the session.get_modelmeta.custom_metadata_map function in ultralytics/nn/autobackend.py. Manipulation of the imgsz/names/kpt_shape arguments leads to improper neutralization of directives in dynamically evaluated code, requiring local access.

ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0 contains a vulnerability in the session.get_modelmeta.custom_metadata_map function in models/MobileSAMv2/ultralytics/nn/autobackend.py. Manipulation of the imgsz/names/kpt_shape arguments leads to improper neutralization of directives in dynamically evaluated code, requiring local access. The exploit is publicly available.

A hard-coded cryptographic key vulnerability exists in /usr/bin/sysman of some Moxa industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some Moxa industrial computing products. A low-privileged authenticated attacker with adjacent network access could access sensitive information, including cryptographic key material.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

The Popup Box plugin for WordPress versions 6.4.1 to 6.4.2 is vulnerable to Arbitrary Shortcode Execution. The ays_popup_get_user_ip() function reads client-controlled headers, sanitizes them only with sanitize_text_field(), substitutes the value into popup body where %%user_ip_address%% token appears, and passes the result to do_shortcode(), allowing unauthenticated attackers to execute arbitrary registered shortcodes.

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market. It could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver. A local authenticated user could cause a blue screen error.

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

A flaw was found in WildFly. A user with the Monitor role, the lowest standard RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location, allowing the Monitor role to read back the server configuration, including sensitive credentials, leading to information disclosure.

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market. An attacker on the same logical network could exploit it to execute arbitrary code.

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.