Overview 76 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
76matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.3%
1CISA KEV1.3%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
76
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
76
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
1.3%
Working exploit published
0
0.0%
Proof of concept only
4
5.3%
Forecast only
0
0.0%
No public exploit
71
93.4%
split by
peak 20 / year
20171
Not applicable1
High1
not blocked1
No public exploit1
20180
20190
20201
Not applicable1
High1
not blocked1
No public exploit1
20218
Not applicable8
High8
not blocked8
No public exploit8
20225
Not applicable5
High5
not blocked5
No public exploit5
202312
Not applicable12
High12
not blocked12
Exploited1
Proof of concept only2
No public exploit9
202411
Not applicable11
High11
not blocked11
No public exploit11
202518
Not applicable18
High18
not blocked18
No public exploit18
202620
Not applicable20
High20
not blocked20
Proof of concept only2
No public exploit18
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-60138 | High | 2026-11-10 | Not applicable | No public exploit | Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-105541 | High | 2026-11-10 | Not applicable | No public exploit | Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-74915 | High | 2026-10-30 | Not applicable | No public exploit | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device. |
| CVE-2026-93862 | High | 2026-10-27 | Not applicable | No public exploit | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service. |
| CVE-2026-104944 | High | 2026-10-06 | Not applicable | No public exploit | TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition. |
| CVE-2026-102757 | High | 2026-09-29 | Not applicable | No public exploit | An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range. |
| CVE-2026-48977 | High | 2026-09-17 | Not applicable | No public exploit | OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1. |
| CVE-2026-45199 | High | 2026-08-21 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges. |
| CVE-2026-72642 | High | 2026-08-13 | Not applicable | No public exploit | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. |
| CVE-2026-49746 | High | 2026-08-07 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages. |
| CVE-2026-49745 | High | 2026-07-24 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges. |
| CVE-2026-49744 | High | 2026-07-24 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries. |
| CVE-2026-21734 | High | 2026-06-26 | Not applicable | No public exploit | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write. |
| CVE-2026-12290 | High | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-28764 | High | 2026-05-21 | Not applicable | No public exploit | A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2026-42946 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41907 | High | 2026-04-24 | Not applicable | Proof of concept only | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0. |
| CVE-2026-4693 | High | 2026-03-24 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
| CVE-2026-32829 | High | 2026-03-20 | Not applicable | No public exploit | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1. |
| CVE-2026-21487 | High | 2026-01-06 | Not applicable | Proof of concept only | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2. |
| CVE-2017-20211 | High | 2025-11-12 | Not applicable | No public exploit | UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file). |
| CVE-2025-11232 | High | 2025-10-29 | Not applicable | No public exploit | To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2. |
| CVE-2025-47349 | High | 2025-10-09 | Not applicable | No public exploit | Memory corruption while processing an escape call. |
| CVE-2025-27059 | High | 2025-10-09 | Not applicable | No public exploit | Memory corruption while performing SCM call. |
| CVE-2025-25180 | High | 2025-07-14 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. |
| CVE-2024-45570 | High | 2025-05-06 | Not applicable | No public exploit | Memory corruption may occur during IO configuration processing when the IO port count is invalid. |
| CVE-2025-0467 | High | 2025-04-18 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-45557 | High | 2025-04-07 | Not applicable | No public exploit | Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. |
| CVE-2024-43060 | High | 2025-03-03 | Not applicable | No public exploit | Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. |
| CVE-2024-52939 | High | 2025-02-22 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory. |
| CVE-2024-12577 | High | 2025-02-22 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-49840 | High | 2025-02-03 | Not applicable | No public exploit | Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality. |
| CVE-2024-45573 | High | 2025-02-03 | Not applicable | No public exploit | Memory corruption may occour while generating test pattern due to negative indexing of display ID. |
| CVE-2024-47900 | High | 2025-01-31 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory. |
| CVE-2024-52938 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory. |
| CVE-2024-47895 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory. |
| CVE-2024-47894 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory. |
| CVE-2024-33041 | High | 2025-01-06 | Not applicable | No public exploit | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
| CVE-2024-42386 | High | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. |
| CVE-2024-42416 | High | 2024-09-05 | Not applicable | No public exploit | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. |
| CVE-2024-6603 | High | 2024-07-09 | Not applicable | No public exploit | In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128. |
| CVE-2024-21475 | High | 2024-05-06 | Not applicable | No public exploit | Memory corruption when the payload received from firmware is not as per the expected protocol size. |
| CVE-2024-1013 | High | 2024-03-18 | Not applicable | No public exploit | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. |
| CVE-2023-33066 | High | 2024-03-04 | Not applicable | No public exploit | Memory corruption in Audio while processing RT proxy port register driver. |
| CVE-2023-43516 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption when malformed message payload is received from firmware. |
| CVE-2023-43513 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. |
| CVE-2023-33067 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points. |
| CVE-2023-33110 | High | 2024-01-02 | Not applicable | No public exploit | The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption. |
| CVE-2023-33033 | High | 2024-01-02 | Not applicable | No public exploit | Memory corruption in Audio during playback with speaker protection. |
| CVE-2023-33106 | High | 2023-12-05 | Not applicable | Exploited | Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. |
| CVE-2023-33079 | High | 2023-12-05 | Not applicable | No public exploit | Memory corruption in Audio while running invalid audio recording from ADSP. |
| CVE-2023-46724 | High | 2023-11-01 | Not applicable | No public exploit | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. |
| CVE-2023-20187 | High | 2023-09-27 | Not applicable | No public exploit | A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect handling of certain IPv6 multicast packets when they are fanned out more than seven times on an affected device. An attacker could exploit this vulnerability by sending a specific IPv6 multicast or IPv6 multicast VPN (MVPNv6) packet through the affected device. A successful exploit could allow the attacker to cause a reload of the affected device, resulting in a DoS condition. |
| CVE-2023-28564 | High | 2023-09-05 | Not applicable | No public exploit | Memory corruption in WLAN HAL while passing command parameters through WMI interfaces. |
| CVE-2023-28575 | High | 2023-08-08 | Not applicable | No public exploit | The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it. |
| CVE-2023-22387 | High | 2023-07-04 | Not applicable | No public exploit | Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption. |
| CVE-2022-46378 | High | 2023-05-10 | Not applicable | Proof of concept only | An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command. |
| CVE-2022-46377 | High | 2023-05-10 | Not applicable | Proof of concept only | An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no IP address argument is provided to the `PORT` command. |
| CVE-2022-25709 | High | 2023-03-10 | Not applicable | No public exploit | Memory corruption in modem due to use of out of range pointer offset while processing qmi msg |
| CVE-2022-25694 | High | 2023-03-10 | Not applicable | No public exploit | Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM |
| CVE-2022-33246 | High | 2023-02-12 | Not applicable | No public exploit | Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id. |
| CVE-2022-42264 | High | 2022-12-30 | Not applicable | No public exploit | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data tampering, data loss, information disclosure, or denial of service. |
| CVE-2022-32142 | High | 2022-06-24 | Not applicable | No public exploit | Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required. |
| CVE-2022-0729 | High | 2022-02-23 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. |
| CVE-2022-0685 | High | 2022-02-20 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. |
| CVE-2022-0554 | High | 2022-02-10 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. |
| CVE-2021-34595 | High | 2021-10-26 | Not applicable | No public exploit | A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite. |
| CVE-2021-3889 | High | 2021-10-19 | Not applicable | No public exploit | libmobi is vulnerable to Use of Out-of-range Pointer Offset |
| CVE-2021-3888 | High | 2021-10-19 | Not applicable | No public exploit | libmobi is vulnerable to Use of Out-of-range Pointer Offset |
| CVE-2021-22550 | High | 2021-06-08 | Not applicable | No public exploit | An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c |
| CVE-2021-22549 | High | 2021-06-08 | Not applicable | No public exploit | An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c |
| CVE-2020-27009 | High | 2021-04-22 | Not applicable | No public exploit | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition. |
| CVE-2021-1352 | High | 2021-03-24 | Not applicable | No public exploit | A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. |
| CVE-2020-13573 | High | 2021-01-07 | Not applicable | No public exploit | A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability. |
| CVE-2020-6112 | High | 2020-09-17 | Not applicable | No public exploit | An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which allow for the decoder to write out of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded inside a PDF and loaded by a victim in order to trigger this vulnerability. |
| CVE-2016-2161 | High | 2017-07-27 | Not applicable | No public exploit | In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests. |