CVE-2023-34401

CVE-2023-34401 affects Mercedes-Benz head-unit NTG6. USB-based profile import/export can process UD2-encoded files; missing size checks in enapsulate file enable an out-of-bounds read on the heap. Connected sources describe the vulnerability across multiple feeds (nvd/nvd-derived entries, Red Hat...

Azure Linux 3.0 Security Update: rubygem-yajl-ruby (CVE-2022-24795)

The version of rubygem-yajl-ruby installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-24795 advisory. - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the...

Azure Linux 3.0 Security Update: gdk-pixbuf2 (CVE-2022-48622)

The version of gdk-pixbuf2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-48622 advisory. - In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters...

CVE-2021-37655

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to tf.rawops.ResourceScatterUpdate. The implementation has an incomplete validation of the...

CVE-2022-21730

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this...

CVE-2022-41900

TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMaxAVGPool with illegal poolingratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote...

CVE-2024-7884

When a canister method is called via iccdk::call , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

CVE-2024-24956

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

CVE-2024-24954

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

Security Bulletin: Vulnerability in linux affects IBM Integrated Analytics System [CVE-2024-46696, CVE-2024-46697]

Summary Redhat provided linux is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2024-46696, CVE-2024-46697 Vulnerability Details CVEID:CVE-2024-46696 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a...

PT-2025-35250

Name of the Vulnerable Software and Affected Versions CivetWeb versions 1.14 through 1.16 Description A buffer overflow in the URI parser of CivetWeb may allow a remote attacker to achieve remote code execution via a crafted HTTP request. This issue is triggered during request processing and may...

Google Chrome V8 Type Obfuscation Vulnerability (CNVD-2025-0599103)

V8 is the JavaScript engine in Google Chrome, which is used to parse and execute JavaScript code in web pages. A type confusion vulnerability exists in Google Chrome V8, which can be exploited by an attacker to cause a heap memory corruption and potentially execute arbitrary code...

Rockwell Automation PowerMonitor 1000 Heap-Based Buffer Overflow (CVE-2024-12372)

A denial-of-service and possible remote code execution vulnerability exists in the affected product. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack. This plug...

CVE-2024-12372

A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a...

CVE-2024-12372 Rockwell Automation PowerMonitor™ 1000 Denial of Service

A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a...

CVE-2024-12372

CVE-2024-12372 affects Rockwell Automation PowerMonitor 1000. The issue enables denial-of-service and potentially remote code execution via heap memory corruption, exploitable over the network through the device API that allows unauthenticated policy changes (admin creation, factory resets). Seve...

Rockwell Automation Power Monitor 1000 安全漏洞

Rockwell Automation Power Monitor 1000 is a power monitor from Rockwell Automation, Inc. A security vulnerability exists in the Rockwell Automation Power Monitor 1000 prior to version 4.020 that stems from the presence of a denial of service and remote code execution vulnerability that could lead...

ABB Cylon Aspect 3.08.02 (aspectMemory.php) Arbitrary Heap Memory Configuration

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description An authenticated access vulnerability in the aspectMemory.php script ...

Huawei EulerOS: Security Advisory for gdk-pixbuf2 (EulerOS-SA-2024-2926)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gdk-pixbuf2 (EulerOS-SA-2024-2920)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...