GTKWave FST fstReaderIterBlocks2 vesc allocation integer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1790 GTKWave FST fstReaderIterBlocks2 vesc allocation integer overflow vulnerability January 8, 2024 CVE Number CVE-2023-35992 SUMMARY An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115,...

JustSystems Corporation Ichitaro 2023 DocumentViewStyles and DocumentEditStyles stream relative write vulnerabilities

Talos Vulnerability Report TALOS-2023-1825 JustSystems Corporation Ichitaro 2023 DocumentViewStyles and DocumentEditStyles stream relative write vulnerabilities October 19, 2023 CVE Number CVE-2023-35126 SUMMARY An out-of-bounds write vulnerability exists within the parsers for both the...

SoftEther VPN vpnserver ConnectionAccept() denial-of-service vulnerability

Talos Vulnerability Report TALOS-2023-1743 SoftEther VPN vpnserver ConnectionAccept denial-of-service vulnerability October 12, 2023 CVE Number CVE-2023-25774 SUMMARY A denial-of-service vulnerability exists in the vpnserver ConnectionAccept functionality of SoftEther VPN 5.02. A set of specially...

SoftEther VPN CtEnumCa() information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1753 SoftEther VPN CtEnumCa information disclosure vulnerability October 12, 2023 CVE Number CVE-2023-32275 SUMMARY An information disclosure vulnerability exists in the CtEnumCa functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted...

Apple DCERPC call request uninitialized memory heap overflow vulnerability

Talos Vulnerability Report TALOS-2022-1677 Apple DCERPC call request uninitialized memory heap overflow vulnerability July 13, 2023 CVE Number CVE-2023-27934 SUMMARY A heap overflow vulnerability exists in the request processing functionality of DCERPC library as used in Apple macOS 12.6.1 that c...

Siretta QUARTZ-GOLD m2m DELETE_FILE cmd directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1637 Siretta QUARTZ-GOLD m2m DELETEFILE cmd directory traversal vulnerability January 26, 2023 CVE Number CVE-2022-41154 SUMMARY A directory traversal vulnerability exists in the m2m DELETEFILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. ...

WWBN AVideo session id privilege escalation vulnerability

Talos Vulnerability Report TALOS-2022-1535 WWBN AVideo session id privilege escalation vulnerability August 16, 2022 CVE Number CVE-2022-30605 SUMMARY A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafte...

Garrett Metal Detectors iC Module CMA check_udp_crc memcpy stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the CMA checkudpcrc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted packet can lead to a stack-based buffer overflow during a call to memcpy. An attacker can send a malicious packet to trigger this...

Advantech R-SeeNet application multiple SQL injection vulnerabilities in the 'group_list' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as...

Adobe Acrobat Reader DC form field format use after free

Talos Vulnerability Report TALOS-2020-1156 Adobe Acrobat Reader DC form field format use after free November 5, 2020 CVE Number CVE-2020-24437 SUMMARY A specific JavaScript code embedded in a PDF file can trigger a use-after-free vulnerability when opening a PDF document in Adobe Acrobat Reader D...

CleanMyMac X removeKextAtPath privilege escalation vulnerability

Summary The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the running kernel extensions on the system. Tested Versions Clean My Mac X 4.04 Product URLs...

Clean My Mac X enableLaunchdAgentAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Clean My Mac X securelyRemoveItemAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Iceni Infix PDF parsing SetSize Code Execution Vulnerability

Summary An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability. Tested Versions...

Pidgin MXIT read stage 0x3 Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0118 Pidgin MXIT read stage 0x3 Code Execution Vulnerability June 21, 2016 CVE Number CVE-2016-2376 DESCRIPTION A buffer overflows vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could...

IBM Domino KeyView PDF Filter Stream Length Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0090 IBM Domino KeyView PDF Filter Stream Length Code Execution Vulnerability June 8, 2016 CVE Number CVE-2016-0278 Description An integer overflow vulnerability present in the PDF filter of KeyView as used by Domino can lead to process crash and possible...

Tp-Link Archer AX53 v1.0 dnsmasq configuration restore TFTP server enable vulnerability

Talos Vulnerability Report TALOS-2025-2305 Tp-Link Archer AX53 v1.0 dnsmasq configuration restore TFTP server enable vulnerability May 7, 2026 CVE Number CVE-2026-30817 SUMMARY An external config control vulnerability exists in the Openvpn configuration restore routeup functionality of Tp-Link...

Canva Affinity EMF File EMR_STRETCHBLT cbBitsSrc Out-Of-Bounds Read Vulnerability

Talos Vulnerability Report TALOS-2025-2313 Canva Affinity EMF File EMRSTRETCHBLT cbBitsSrc Out-Of-Bounds Read Vulnerability March 17, 2026 CVE Number CVE-2025-66633 SUMMARY An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file...

Adobe Acrobat Reader Font Private Point Numbers Out-Of-Bounds Read Vulnerability

Talos Vulnerability Report TALOS-2024-2070 Adobe Acrobat Reader Font Private Point Numbers Out-Of-Bounds Read Vulnerability December 11, 2024 CVE Number CVE-2024-49533 SUMMARY An out-of-bounds read vulnerability exists in font handling code of Adobe Acrobat Reader 2024.002.21005. A font file with...

GoCast name parameter OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-1960 GoCast name parameter OS command injection vulnerability November 21, 2024 CVE Number CVE-2024-28892 SUMMARY An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary comman...

LevelOne WBR-6012 Web Application authentication bypass vulnerability

Talos Vulnerability Report TALOS-2024-1996 LevelOne WBR-6012 Web Application authentication bypass vulnerability October 30, 2024 CVE Number CVE-2024-23309 SUMMARY The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance ...

GNOME Project G Structured File Library (libgsf) Compound Document Binary File Sector Allocation Table integer overflow vulnerability

Talos Vulnerability Report TALOS-2024-2069 GNOME Project G Structured File Library libgsf Compound Document Binary File Sector Allocation Table integer overflow vulnerability October 3, 2024 CVE Number CVE-2024-42415 SUMMARY An integer overflow vulnerability exists in the Compound Document Binary...

Realtek rtl819x Jungle SDK boa updateConfigIntoFlash integer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1877 Realtek rtl819x Jungle SDK boa updateConfigIntoFlash integer overflow vulnerability July 8, 2024 CVE Number CVE-2023-45742 SUMMARY An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1850 TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-43482 SUMMARY A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VP...

WWBN AVideo salt generation insufficient entropy vulnerability

Talos Vulnerability Report TALOS-2023-1900 WWBN AVideo salt generation insufficient entropy vulnerability January 10, 2024 CVE Number CVE-2023-49599 SUMMARY An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially...

GTKWave LXT2 lxt2_rd_expand_integer_to_bits stack-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1827 GTKWave LXT2 lxt2rdexpandintegertobits stack-based buffer overflow vulnerability January 8, 2024 CVE Number CVE-2023-38583 SUMMARY A stack-based buffer overflow vulnerability exists in the LXT2 lxt2rdexpandintegertobits function of GTKWave 3.3.115. A...

Accusoft ImageGear dcm_pixel_data_decode out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2023-1802 Accusoft ImageGear dcmpixeldatadecode out-of-bounds write vulnerability September 25, 2023 CVE Number CVE-2023-32653 SUMMARY An out-of-bounds write vulnerability exists in the dcmpixeldatadecode functionality of Accusoft ImageGear 20.1. A specially craft...

Open Babel MSI format atom uninitialized pointer dereference vulnerability

Talos Vulnerability Report TALOS-2022-1669 Open Babel MSI format atom uninitialized pointer dereference vulnerability July 21, 2023 CVE Number CVE-2022-44451 SUMMARY A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit...

Slic3r libslic3r TriangleMesh clone heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2022-1593 Slic3r libslic3r TriangleMesh clone heap-based buffer overflow vulnerability April 20, 2023 CVE Number CVE-2022-36788 SUMMARY A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master...

Siretta QUARTZ-GOLD m2m DELETE_FILE cmd heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2022-1639 Siretta QUARTZ-GOLD m2m DELETEFILE cmd heap-based buffer overflow vulnerability January 26, 2023 CVE Number CVE-2022-41991 SUMMARY A heap-based buffer overflow vulnerability exists in the m2m DELETEFILE cmd functionality of Siretta QUARTZ-GOLD...

OpenImageIO TIFF tile pels decoding heap-based buffer overflow

Talos Vulnerability Report TALOS-2022-1633 OpenImageIO TIFF tile pels decoding heap-based buffer overflow December 22, 2022 CVE Number CVE-2022-41639 SUMMARY A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and...

OpenStack oslo.privsep privilege escalation vulnerability

Talos Vulnerability Report TALOS-2022-1599 OpenStack oslo.privsep privilege escalation vulnerability December 20, 2022 CVE Number CVE-2022-38065 SUMMARY A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive...

HDF5 Group libhdf5 gif2h5 out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2022-1486 HDF5 Group libhdf5 gif2h5 out-of-bounds read vulnerability August 16, 2022 CVE Number CVE-2022-25942 SUMMARY An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to cod...

WWBN AVideo password hash improper authentication vulnerability

Talos Vulnerability Report TALOS-2022-1545 WWBN AVideo password hash improper authentication vulnerability August 16, 2022 CVE Number CVE-2022-32282 SUMMARY An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a...

Gerbv RS-274X aperture macro outline primitive integer overflow vulnerability

Summary An integer overflow vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev commit b5f1eacd and the forked version of Gerbv commit 71493260. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious fi...

Lantronix PremierWave 2050 Web Manager Diagnostics: Traceroute OS command injection vulnerability

Summary An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this...

Prusa Research PrusaSlicer _3MF_Importer::_handle_end_model() use-after-free vulnerability

Summary A use-after-free vulnerability exists in the 3MFImporter::handleendmodel functionality of Prusa Research PrusaSlicer 2.2.0 and Master commit 4b040b856. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested...

Videolabs libmicrodns 0.1.0 message-parsing bounds denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading to an out-of-bounds read that would...

Samsung SmartThings Hub video-core samsungWifiScan Callback Code Execution Vulnerability

Summary An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core’s HTTP server of Samsung SmartThings Hub. The video-core process incorrectly handles the answer received from a smart camera, leading to a buffer overflow on the stac...

Blender Sequencer imb_loadiris Integer Overflow Code Execution Vulnerability

Summary An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .iris file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the...

libxls xls_addCell MulBlank Code Execution Vulnerability

Summary An exploitable Out-of-bounds Write vulnerability exists in the xlsaddCell function of libxls 1.4. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability. Tested Versions libxls 1....

Ichitaro Word Processor PersistDirectory Code Execution Vulnerability

Summary Ichitaro Office contains a vulnerability that exists when trying to open a specially crafted PowerPoint file. Due to the application incorrectly handling the error case for a function’s result, the application will use this result in a pointer calculation for reading file data into. Due t...

Joyent SmartOS Hyprlofs FS IOCTL Add Entries 32-bit File System Denial of Service Vulnerability

Summary An exploitable denial of service exists in the the Joylent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never...

Iceni Argus ipfSetColourStroke Code Execution Vulnerability

Summary An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus. A specially crafted pdf file can cause a buffer overflow resulting in arbitrary code exection. An attacker can provide a malicious pdf file to trigger this vulnerability...

Oracle OIT IX SDK libvs_pdf Root xref Denial of Service Vulnerabiity

Talos Vulnerability Report TALOS-2016-0099 Oracle OIT IX SDK libvspdf Root xref Denial of Service Vulnerabiity July 19, 2016 CVE Number CVE-2016-3577 DESCRIPTION A stack overflow leading to a crash due to unbounded recusive function call is present in the PDF file format parsing code of the IX SD...

IBM Domino KeyView PDF Filter Trailer ID Code Execution Vulnerability

SUMMARY A heap based buffer overflow vulnerability present in KeyView PDF filter as used by Domino can lead to remote arbitrary code execution. TESTED VERSIONS KeyView 10.16 as used by IBM Domino 9.0.1 PRODUCT URLs http://www-03.ibm.com/software/products/en/ibmdomino DETAILS While parsing an ID...

Network Time Protocol ntpq Buffer Overflow Vulnerability

CERT VU357792 Summary ntpq contains a buffer overflow. nextvar executes a memcpy into the name buffer without a proper length check against its maximum length of 256 bytes. Tested Versions ntp 4.2.8p3 NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 Product URLs http://www.ntp.orghttp://www.ntp.or...

Asus Armoury Crate AsIO3.sys authorization bypass vulnerability

Talos Vulnerability Report TALOS-2025-2150 Asus Armoury Crate AsIO3.sys authorization bypass vulnerability June 16, 2025 CVE Number CVE-2025-3464 SUMMARY An authorization bypass vulnerability exists in the AsIO3.sys functionality of Asus Armoury Crate 5.9.13.0. A specially crafted hard link can...

miniaudio ma_dr_flac__decode_samples__lpc out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2024-2063 miniaudio madrflacdecodesampleslpc out-of-bounds write vulnerability March 4, 2025 CVE Number CVE-2024-41147 SUMMARY An out-of-bounds write vulnerability exists in the madrflacdecodesampleslpc functionality of Miniaudio miniaudio v0.11.21. A specially...

Microsoft High Definition Audio Bus Driver HDAudBus_DMA multiple irp complete requests vulnerability

Talos Vulnerability Report TALOS-2024-2008 Microsoft High Definition Audio Bus Driver HDAudBusDMA multiple irp complete requests vulnerability September 12, 2024 CVE Number CVE-2024-45383 SUMMARY A mishandling of IRP requests vulnerability exists in the HDAudBusDMA interface of Microsoft High...