Information Disclosure

opensearch-anomaly-detection is vulnerable to Information Disclosure. The vulnerability exists because of the lack of access restrictions in field-level rules in numerical feature aggregations of the library, allowing a user with the Anomaly Detector role to read aggregated numerical data...

CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data e.g. averages,...

CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data e.g. averages,...

CVE-2023-23933

CVE-2023-23933 concerns OpenSearch Anomaly Detection: the plugin improperly applies document- and field-level restrictions, allowing users with the Anomaly Detector role to read aggregated numerical data from restricted fields. This affects authenticated users who already had read access to the r...

The vulnerability of the nmreq_copyin() function in the netmap component of FreeBSD allows a hacker to execute arbitrary code in the kernel context.

The vulnerability of the nmreqcopyin function in the netmap component of FreeBSD operating systems is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the kernel context...

The vulnerability of the CJBig2Image::expand() function in Kindle electronic book readers allows a hacker to execute arbitrary code.

The vulnerability of the CJBig2Image::expand function in Kindle e-book readers is due to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created PDF file...

The vulnerability in the `QuickTimeVideo::userDataDecoder` function of the `quicktimevideo.cpp` file in the library and command-line utilities for managing image metadata from Exiv2 allows a hacker to cause a service failure.

The vulnerability of the QuickTimeVideo::userDataDecoder function in the quicktimevideo.cpp file of the Exiv2 image metadata management library and command-line utility is related to a numerical overflow vulnerability. Exploiting this vulnerability could allow an attacker to perform a...

CVE-2022-41648

The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line,...

The vulnerability of the gst_matroska_demux_add_wvpk_header function in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.

The vulnerability of the gstmatroskademuxaddwvpkheader function in the Gstreamer multimedia framework is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the gst_avi_demux_invert function in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.

The vulnerability of the gstavidemuxinvert function in the Gstreamer multimedia framework is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the driver vmwgfx (drivers/gpu/vmxgfx/vmxgfx_execbuf.c) of the Linux operating system’s GPU kernel, which allows a hacker to trigger a service failure

The vulnerability of the vmwgfx driver drivers/gpu/vmxgfx/vmxgfxexecbuf.c, which is part of the Linux operating system’s GPU kernel, is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the kernel of microprogramming software in Qualcomm’s embedded chips allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the kernel of microprogramming software in Qualcomm’s embedded chips is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause malfunctions or execute arbitrary code...

The vulnerability in the packet.c component of the SSH2 protocol implementation library Libssh2 allows a attacker to access confidential data and also cause a service denial.

The vulnerability of the packet.c component in the SSH2 protocol implementation library Libssh2 is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to gain access to confidential data and also cause service failures...

The vulnerability of the vmxnet3 network card emulator, a component of the QEMU hardware emulation software, allows a hacker to induce a service failure.

The vulnerability of the vmxnet3 network card emulator, a component of the QEMU hardware emulation software, is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to cause a system failure...

Newton's iteration convergence might not converge

Lines of code Vulnerability details Impact In getAmountOut for stable pair, Newton's method is used, however there is no check for the solution convergence. The numerical stability for Newton's method only applies to initial value close enough to the real solution. If the iteration fail to...

The vulnerability of the pxa3xx_gcu_write function in the Linux operating system’s kernel allows a hacker to execute arbitrary code.

The vulnerability of the pxa3xxgcuwrite function drivers/video/fbdev/pxa3xx-gcu.c in the Linux kernel is caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the SBIOS component in the NVIDIA DGX A100 server’s SmmCore allows a hacker to execute arbitrary code, cause system failures, and compromise the confidentiality and integrity of protected information.

The vulnerability of the SBIOS component in NVIDIA’s SmmCore server NVIDIA DGX A100 is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code, cause service failures, and compromise the confidentiality and integrity of the protected informati...

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library, which allows a hacker to trigger a service failure.

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library is related to a numerical overflow in the hb-ot-shape-fallback.cc file. Exploiting this vulnerability could allow an attacker to cause a service failure by sending specially crafted data to the...

Vulnerability Spotlight: Three vulnerabilities in HDF5 file format could lead to remote code execution

Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered three vulnerabilities in a library that works with the HDF5 file format that could allow an attacker to execute remote code on a targeted device. These issues arise in the libhdf5...

The vulnerability of the executable file IGSSdataServer.exe of the Data Server module in the Interactive Graphical SCADA System (IGSS) allows a perpetrator to execute arbitrary code.

The vulnerability of the IGSSdataServer.exe executable file of the Data Server module in the Interactive Graphical SCADA System IGSS is related to a numerical overflow vulnerability. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending a specially crafted...