PT-2024-40433 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue occurs when the parser fails to handle the conversion of an empty string to a SurrealDB value, such as when casting to a record, duration, or datetime, or when parsing an empty string t...

PT-2024-40593 · Git +1 · Assimp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions, including dynamic cast, HandleDynamicTypeCacheMiss, and...

assimp:assimp_fuzzer: Bad-cast to Assimp::LogStreamCallbackToLogRedirector in Assimp::DefaultLogger::WriteToStreams

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4735827571179520 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5cbc303690c0 Crash State:...

CVE-2024-45987

Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery CSRF via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent ...

assimp:assimp_fuzzer: Bad-cast to Assimp::LogStream from invalid vptr in LogToCallbackRedirector::~LogToCallbackRedirector

Detailed Report: https://oss-fuzz.com/testcase?key=5651401240281088 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x570dfd37cab0 Crash State: Bad-cast to Assimp::LogStream from invalid vptr...

OSV-2024-1054 Bad-cast to Assimp::LogStream from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538150 Crash type: Bad-cast Crash state: Bad-cast to Assimp::LogStream from invalid vptr CallbackToLogRedirector Assimp::DefaultLogger::WriteToStreams...

PT-2024-40570 · Assimp · Assimp

Name of the Vulnerable Software and Affected Versions: Assimp affected versions not specified Description: The issue is related to a crash caused by a bad-cast in the Assimp library. Specifically, it involves a bad-cast to Assimp::LogStream from an invalid vptr, occurring in the...

libreoffice:fodtfuzzer: Bad-cast to SwDrawFrameFormat from SwFlyFrameFormat in SwContact::GetFormat

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4853648008478720 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: fodtfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address:...

assimp:assimp_fuzzer: Bad-cast to Assimp::LogStream from invalid vptr in CallbackToLogRedirector

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4550823252656128 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5ad54fb106e0 Crash State:...

OSV-2024-838 Bad-cast to RDKit::AtomRDKit::ROMol::initFromOther

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68998 Crash type: Bad-cast Crash state: Bad-cast to RDKit::AtomRDKit::ROMol::initFromOther RDKit::ROMol::ROMol RDKit::RecursiveStructureQuery::copy...

PT-2024-40858

Name of the Vulnerable Software and Affected Versions RDKit affected versions not specified Description The issue is related to a crash caused by a bad-cast in the RDKit library. Specifically, the crash occurs when there is a bad-cast to RDKit::AtomRDKit::ROMol::initFromOther, which is part of th...

RUSTSEC-2024-0363 Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow,...

SUSE CVE-2024-42066

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix potential integer overflow in page size calculation Explicitly cast tbo-pagealignment to u64 before bit-shifting to prevent overflow when assigning to minpagesize...

The kstring integration in gix-attributes is unsound

gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...

CVE-2024-36246

Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-23847

Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-36246

Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-36246

Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-36246

CVE-2024-36246 corresponds to a Missing Authorization for coejobhook Command Execution (CWE-862) in Yokogawa Unifier and Unifier Cast. Public sources confirm an Arbitrary Code Execution vector with LocalSystem privileges if exploited. Affected versions include Unifier and Unifier Cast 5.0+ (befor...

CVE-2024-23847

Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...