CVE-2023-44443

CVE-2023-44443 describes a Remote Code Execution in GIMP via PSP file parsing. The root cause is lack of validation of PSP data, causing an integer overflow during memory write. Impact is high: attacker-controlled code executed with the current process, with UI interaction required (user must ope...

CVE-2023-44442

CVE-2023-44442 : GIMP PSD parsing heap-based buffer overflow leading to remote code execution. The flaw arises from insufficient validation of the length of user-supplied data during PSD file parsing, copying to a heap buffer. Exploitation requires user interaction (visiting a malicious page or o...

CVE-2023-44441

CVE-2023-44441 describes a heap-based buffer overflow in GIMP’s DDS file parsing, enabling remote code execution. The issue arises from insufficient validation of the length of user-supplied data before copying to a heap buffer and requires user interaction (visiting a malicious page or opening a...

CVE-2023-44440

CVE-2023-44440 affects Ashlar-Vellum Lithium. The vulnerability arises during parsing of various file types, where the process loads a library from an unsecured location, enabling an attacker to execute code in the context of the current process. Exploitation requires user interaction: the target...

CVE-2023-44439

CVE-2023-44439 affects Ashlar-Vellum Xenon. The flaw is in the parsing of various file types, where the process loads a library from an unsecured location, enabling an attacker to execute code in the context of the current process. Remote exploitation requires user interaction (target must visit ...

CVE-2023-44437

CVE-2023-44437 affects Ashlar-Vellum Cobalt. The flaw is in the parsing of file types where the process loads a library from an unsecured location, enabling a threat actor to execute code in the current process. Exploitation requires user interaction (the target must visit a malicious page or ope...

CVE-2023-44436

Kofax Power PDF has a Use-After-Free vulnerability in PDF file parsing (CVE-2023-44436) that allows remote code execution when a user opens a malicious file or visits a malicious page. The flaw stems from not validating object existence before operations, enabling code execution in the process co...

CVE-2023-44435

Kofax Power PDF has a Use-After-Free vulnerability in PDF file parsing that can allow remote code execution. The flaw arises from not validating the existence of a PDF object before performing operations, enabling code execution in the current process. Exploitation requires user interaction (targ...

CVE-2023-44432

The CVE-2023-44432 issue affects Kofax Power PDF and stems from the PDF parsing code allowing an out-of-bounds write. The vulnerability enables remote code execution and requires user interaction (visiting a malicious page or opening a malicious file). The root cause is inadequate validation of u...

CVE-2023-44431

BlueZ AVRCP Stack-based Buffer Overflow (CVE-2023-44431) allows remote code execution when a device connects via Bluetooth. Root-level code execution is possible due to insufficient validation of the AVRCP data length before copying into a fixed-size stack buffer. Exploitation requires network-ad...

CVE-2023-44429

CVE-2023-44429 affects the GStreamer AV1 codec parser and is a heap-based buffer overflow that allows remote code execution. The flaw lies in parsing AV1 video data where user-supplied lengths are not properly validated before copying into a fixed-length heap buffer, enabling code execution in th...

CVE-2023-44426

CVE-2023-44426 affects the D-Link DIR-X3260 router. The flaw is in prog.cgi handling HNAP requests to the lighttpd webserver (ports 80/443). It lacks proper validation of a user-supplied string used to invoke a system call, allowing an attacker to execute code with root privileges. Authentication...

CVE-2023-44423

The CVE-2023-44423 entry concerns D-Link DIR-X3260 routers. A flaw in prog.cgi handling HNAP requests on the lighttpd webserver (ports 80/443) allows a constructed input string to be used in a system call, enabling remote code execution with root privileges. This is a command-injection vulnerabil...

CVE-2023-44422

The CVE-2023-44422 entry affects D-Link DIR-X3260 routers. The vulnerability resides in prog.cgi (HNAP handling) served by lighttpd on ports 80/443, where unsafely passed user input is used in a system call, allowing an attacker on the same network to execute code as root. The flaw enables remote...

CVE-2023-44411

CVE-2023-44411 covers a vulnerability in D-Link D-View where the flaw resides in the InstallApplication class, which contains a hard-coded password for the remotely reachable database. This allows a remote attacker to bypass authentication on affected installations, effectively compromising acces...

CVE-2023-44409

Summary: CVE-2023-44409 affects the D-Link DAP-1325, where the HNAP1 SOAP endpoint mishandles XML data, failing to validate data length before copying into a fixed-size stack buffer. This causes a stack-based overflow that can allow a network-adjacent attacker to execute code with root privileges...

CVE-2023-44410

CVE-2023-44410 affects D-Link D-View. The vulnerability resides in the showUsers method, where insufficient authorization allows remote attackers to escalate privileges to otherwise protected resources. Exploitation requires authentication. Impact is described as privilege escalation with high se...

CVE-2023-42131

CVE-2023-42131 targets Ansys SpaceClaim, exploiting an out-of-bounds write in the parsing of X_B files. The flaw arises from insufficient validation of user-supplied data, allowing an attacker to write past the end of an allocated data structure and execute arbitrary code in the target process. E...

CVE-2023-42129

CVE-2023-42129 affects A10 Networks’ Thunder ADC ; the vulnerability is in the ShowTechDownloadView class, caused by a lack of validation for a user-supplied path used in file operations. This directory traversal could allow an attacker to disclose sensitive information with authentication requir...

CVE-2023-42130

The CVE-2023-42130 issue affects A10 Thunder ADC, specifically the FileMgmtExport class, where improper validation of a user-supplied path enables a directory traversal that can read and delete arbitrary files. The vulnerability context is authenticated use, with the impact described as read/dele...