| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
| Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. |
| Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. |
| Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5. |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. |
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
| External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. |
| Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
| Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
| Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0. |
| LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14. |
