CVE Vulnerability Catalog

An Out-of-Bounds Write vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, data corruption, or arbitrary code execution in the context of the current process.

Vulnerability in udisks2 allows a local attacker with an active console session to exploit insufficient authorization on the 'as-user' option in the Mount() D-Bus method. This allows spoofing and mounting filesystems on behalf of other users, leading to privilege escalation.

Untrusted Pointer Dereference vulnerability when parsing a malicious BMP file in certain Autodesk products. Could allow arbitrary code execution.

Vulnerability in the PHP library league/commonmark (versions 0.6.0 to 2.9.0) causes quadratic time complexity when parsing specially crafted Markdown lines. An attacker can submit a small request that consumes disproportionate CPU time.

Vulnerability in Nx (versions 20.8.0 to 22.7.7 and 23.0.2) in the self-hosted HTTP remote cache. A malicious cache server can return a crafted tar archive that writes files outside the cache directory, potentially leading to remote code execution.

Reflected XSS vulnerability in AIL Framework at the /tag/add_tags endpoint. The error value is returned without proper encoding, allowing arbitrary HTML or JavaScript execution in the victim's browser.

Vulnerability in Traefik (versions 3.0.0 to 3.6.25 and 3.7.10) in the Kubernetes Gateway API provider. Router and service identity construction can cause collisions, allowing overwriting another namespace's backend.

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer and achieve remote code execution.

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution.

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation and potentially disrupting dependent OAuth integrations.

TimescaleDB through 2.29.1 contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with direct DML access to a non-frozen physical compressed hypertable relation can trigger an out-of-bounds read, resulting in incorrect aggregation output, backend SIGSEGV, or PostgreSQL crash recovery.

TimescaleDB through 2.29.1 contains an out-of-bounds read in the Dictionary compression reverse row iterator, where the reverse path does not validate the Simple8b index, allowing attackers with DML access to a physical compressed relation to disclose backend memory including the shared buffer pool as a normal column value. Attackers can store a crafted datum and run a reverse-order scan, leading to memory disclosure that SQL access control does not cover.

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution.

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port receives the full live system configuration with one parameterless GET. Credential-bearing fields such as dinkyToken, LDAP passwords, OSS keys, and DolphinScheduler token are returned in cleartext, leading to sensitive data leakage.

Insecure Permissions vulnerability in ICS-Park v2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and /system/user/update endpoint in UserController.java.

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

PHP_CodeSniffer prior to versions 3.13.6 and 4.0.2 contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. Running PHP_CodeSniffer over untrusted files, for example in a CI pipeline that scans pull requests, could result in attacker controlled shell commands being executed when the report processes a file whose name contains shell metacharacters. Users using the default Full report or other non-blame reports are not affected.

pymdown-extensions up to version 11.0 contains a vulnerability to catastrophic backtracking in four inline processors (caret, tilde, betterem, magiclink). A single untrusted Markdown line under 50 bytes can cause unbounded CPU usage, enabling a remote attacker to cause denial of service. The issue is fixed in version 11.0.1.

Statamic before versions 5.74.1 and 6.24.0, when OAuth login is enabled with a provider that does not guarantee verified email addresses, allows an unauthenticated attacker to sign in as an existing user, including a super admin, without knowing the password. This is because the application matches OAuth identities to accounts by email address alone. The issue is fixed in versions 5.74.1 and 6.24.0.