AISLE CVE Discoveries

Integer underflow in WPS Enrollee fragment length handling via truncated EAP-WSC packets

Command injection in rpmuncompress via unescaped filenames passed to popen()

Command injection in rpmbuild via unescaped tarball path

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Heap buffer overflow when decompressing page data from crafted .solv files

Stack buffer overflow in rrdcached via an oversized CREATE request

Stack buffer overflow in libnv via file descriptors exceeding FD_SETSIZE in select()

Buffer over-read and over-write in ngx_http_mp4_module when processing crafted MP4 files

Argument injection in the APT backend via crafted package names leading to root code execution

Integer overflow in SplashOutputDev::tilingPatternFill leading to heap buffer overflow

Command injection in initialize_kerberos_keytab_file_login()

Stored XSS in the prescription multi-print view via patient demographic fields

Broken sensitivity check lets restricted users view sensitive group encounters

Stored DOM XSS in the portal signer modal via unsanitized patient names

Stored XSS in the CCDA document preview via unsanitized linkHtml attributes

Out-of-bounds write in avrc_vendor_msg() when handling AVRCP vendor commands

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

Stack-based Buffer Overflow in Wireshark

Unauthenticated DoS in via unbounded request body read

Unauthenticated DoS in `/ipa/migration/migration.py` via unbounded request body read

Unbounded peer-controlled json parameters enables remote denial of service via resource exhaustion

Unauthenticated disclosure of the Active Directory default join password via adInfo()

Unbounded memory request in AcquireAlignedMemory leading to out-of-memory condition

Missing check in the DCM decoder allows images with invalid dimensions, causing crashes

Stack buffer overflow verifying EdDSA PGP signatures with mismatched MPI lengths

NULL pointer dereference during OCSP chain checking with partial-chain verification

Denial of service via duplicate sequence numbers in DTLS packet reordering

NULL pointer dereference in mod_dav_lock via a malicious request

Unvalidated Telegram webhook secret allows forged updates that bypass sender allowlists

NULL pointer dereference when processing CMS KeyTransportRecipientInfo

NULL pointer dereference when processing CMS KeyAgreeRecipientInfo

NULL pointer dereference when processing a delta CRL missing the CRL Number extension

Out-of-bounds read when processing partial AES-CFB128 blocks on AVX-512 systems

Pre-authentication memory exhaustion via a WebSocket compression bomb

Improper array index validation in the PostgreSQL protocol parser causing a panic

Webhook authentication bypass in the BlueBubbles plugin via loopback address trust

Cross-board IDOR in checklist deletion via unverified cardId-to-board relationship

Cross-board IDOR in checklist creation via unverified cardId-to-board relationship

Missing object relationship validation in the attachment upload API

Double free in fz_fill_pixmap_from_display_list() error handling during barcode decoding

Session timeout bypass via the skip_timeout_reset parameter

SQL injection in apidoc queue insertion via an unescaped filename

Predictable verification hashes in election account requests

Unauthenticated SSRF in getversion.php via the url parameter

SSRF protection bypass via address ranges missing from the local IP denylist

Unauthenticated resource exhaustion via stalled ACME TLS-ALPN handshakes

Missing connection throttling in the system-mode RDP listener allows unauthenticated DoS