A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the YUV encoder. This leak occurs when a specific encoder operation fails, causing allocated memory not to be released. An attacker can exploit this by supplying crafted input that triggers the failure, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity score of 3.7 and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an XML injection vulnerability in the CIP encoder. This flaw occurs because the encoder does not properly escape input-derived data when generating Cisco IP Phone XML output. An attacker can craft a file that, when converted to CIP format, injects arbitrary XML markup. The vulnerability has a medium severity with a CVSS score of 5.3.
A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the PNG encoder. This occurs when libpng initialization fails and allocated memory is not released. Repeated triggering of this failure can exhaust system memory, potentially causing a denial of service. The vulnerability has a medium severity score of 3.7 and does not impact confidentiality or integrity.
FreeRDP versions before 3.32.0 have a double-free vulnerability in the function nsc_context_initialize_encode(). This flaw occurs after a partial buffer growth failure, leaving dangling plane pointers. An attacker using a specially crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger an allocation failure, causing the server to crash during context teardown. The vulnerability has a CVSS score of 5.9 and is classified as high severity due to its potential to cause denial of service.
ImageMagick versions 7.1.1-7 up to but not including 7.1.2-32 contain a heap buffer over-read vulnerability caused by incorrect string termination in XMP profiles. This flaw allows attackers to craft images with malformed XMP profiles that trigger reading beyond allocated memory, potentially crashing the application. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or integrity but affects availability due to application crashes.
ImageMagick versions from 7.1.0-20 up to but not including 7.1.2-32 contain a low severity vulnerability involving an invalid memory free in the fx operation. This occurs when initialization of an FX runtime entry fails, potentially causing memory corruption and application crashes. The vulnerability does not impact confidentiality or integrity but affects availability due to possible crashes.
A memory leak vulnerability exists in the SVG encoder (WriteSVGImage) of ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32. This flaw causes allocated memory to not be released when processing crafted SVG images, potentially leading to denial of service through resource exhaustion.
FreeRDP versions 3.10.0 through 3.32.2 contain a heap buffer overflow vulnerability in the WinPR png_write_data callback. This flaw occurs when a malicious RDP clipboard peer supplies a large CF_DIB image that triggers an out-of-bounds memcpy during PNG conversion, causing the client to crash. The vulnerability requires user interaction and a high attack complexity, with no impact on confidentiality or integrity but causing denial of service.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain an integer truncation vulnerability in the license_check_stream_length function. This flaw allows a malicious RDP server to send a specially crafted SERVER_LICENSE_REQUEST with a large scopeCount value that bypasses length checks. On 32-bit clients, this triggers a heap buffer overflow, potentially leading to denial of service or remote code execution.
FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain a NULL pointer dereference vulnerability in the RDPEAR NDR reader. This flaw allows malicious servers to crash FreeRDP clients by sending specially crafted truncated KERB_RPC_INTERNAL_NAME data. The issue arises when a CreateApReqAuthenticatorReq message with a NameCount of two or more ends before the Names pointer, causing a null pointer dereference during cleanup and terminating the client application.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain a heap out-of-bounds read vulnerability in the function freerdp_assistance_parse_all_elements_of(). This occurs because the parsing cursor advances without properly reducing the remaining length, allowing the scan window to exceed the decrypted ConnectionString2 buffer. An attacker can exploit this by supplying a crafted .msrcIncident invitation file and password, causing the xfreerdp client to crash upon opening the file, before any RDP connection is established.
FreeRDP versions prior to 3.32.0 contain a heap buffer overflow vulnerability in the collect_keys() function. This flaw allows local attackers controlling smartcard tokens to write beyond the fixed 64-entry keys array during PKCS#11 key enumeration. By presenting more than 64 public key objects across multiple slots, attackers can corrupt heap memory with attacker-controlled data during smartcard logon.
FreeRDP versions from 2.1.0 up to but not including 3.32.0 contain a use-after-free vulnerability in the static rdpsnd channel disconnect path. This flaw occurs when a malicious RDP server disconnects during asynchronous Wave2 playback, causing the client to access freed heap memory and potentially crash. The vulnerability has a medium severity rating with a CVSS score of 5.9.
FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers. This flaw occurs because the code checks value length before consuming alignment padding, allowing malicious or compromised RDP servers to send crafted unaligned RDPEAR payloads. Such payloads, including CreateApReqAuthenticatorReq messages, can cause the client process to over-read memory and potentially crash. The vulnerability affects clients using Remote Credential Guard. The CVSS score is 5.3, indicating medium severity, with no confidentiality or integrity impact but a potential denial of service via client crash. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
FreeRDP versions before 3.32.0 have a vulnerability where the server-supplied signed MS-RDPEGT geometry origin is stored unchecked in an unsigned video surface coordinate. This causes the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped. A malicious RDP server can exploit this by sending a negative topLevelLeft value to clients connecting with the /video option, leading to an out-of-bounds write of decoded H.264 picture data or a client abort.
A critical buffer overflow vulnerability exists in the Edimax BR-6208AC firmware version 1.32, specifically in the /goform/formWlSiteSurvey functionality. This flaw allows remote attackers with low privileges to execute arbitrary code or cause denial of service. The vulnerability has a high CVSS score of 9.9 and an exploit has been published. The affected product is no longer supported by the vendor, and no patch or remediation has been provided.
Netcore NR268 version 1.7.121109 contains a critical vulnerability in the user_ok function of its CGI Execution component that allows improper authentication. This flaw can be exploited remotely without any privileges or user interaction. The vulnerability has a maximum CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability. The vendor was notified but has not responded or issued a patch. Public exploit details have been disclosed, though no active exploitation in the wild is currently known.
FreeRDP versions from 3.11.0 up to but not including 3.32.1 contain a reachable assertion vulnerability in the urb_isoch_transfer function. This flaw allows a malicious RDP server to crash the client by sending a specially crafted OutputBufferSize value that exceeds INT32_MAX. The vulnerability triggers an assertion failure in libusb_udev_isoch_transfer, causing client termination. The CVSS score is 3.1, indicating low severity, with no confidentiality or integrity impact, only availability impact due to client crash.
FreeRDP versions before 3.32.0 have a path traversal vulnerability in the function convert_filedescriptors_to_file_list(). This flaw allows a malicious RDP server to manipulate clipboard data such that the client user may inadvertently copy arbitrary local files instead of the intended remote files. The vulnerability arises because the code concatenates server-supplied file names into local file URIs without properly sanitizing path traversal sequences like '../'.
A cross-site scripting (XSS) vulnerability exists in Netcore NR268 version 1.7.121109 within the Web UI component, specifically in the eval function of /router/l7_call_board_user_set.cgi. The vulnerability allows remote attackers to manipulate arguments such as title, note, URL, or content to execute script code. The vendor has not responded to disclosure attempts, and no patch information is available. The CVSS score is low (2.4), indicating limited impact.