CWE-1284.

Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform

• BlackBerry Ltd QNX Software Development Platform
• CWE-1284

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

• Erlang OTP
• Memory corruption
• Denial of service

WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

• magepeopleteam Booking and Rental Manager
• CWE-1284

WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

• Anh Tran Falcon – WordPress Optimizations & Tweaks
• CWE-1284

Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

• Apache Software Foundation Apache Thrift
• Memory corruption
• CWE-1284

nic Knot Resolver: Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow…

• nic Knot Resolver
• CWE-1284

Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

• ISC BIND 9
• CWE-1284

Key Record using PRIVATEDNS algorithm may lead to unexpected exit

• ISC BIND 9
• Denial of service
• CWE-1284

Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass

• NLnet Labs Unbound
• CWE-1284

CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

• GreycLab CImg
• Denial of service
• CWE-1284

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

• Memory corruption
• Denial of service

<3.8.4 || >=4.0.0-rc.1, <4.3.9 || >=5.0.0-beta.1, <5.1.8 · fixed in 3.8.4, 4.3.9, 5.1.8

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

• CWE-345
• CWE-1284

<3.3.0 · fixed in 3.3.0

vLLM has Remote DoS via Invalid Recovered Token Reinjection

• CWE-20
• CWE-1284

>=0.17.1, <0.24.0 · fixed in 0.24.0

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

• Denial of service
• CWE-1284

>=0.32.6, <0.32.8 · fixed in 0.32.8

WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability

• WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More
• CWE-1284

Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash

• Juniper Networks Junos OS
• CWE-1284

Junos OS: MX Series: Specific traffic causes an FPC to reset

• Juniper Networks Junos OS
• CWE-1284

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

• Memory corruption
• CWE-1284

<4.0.2.8 · fixed in 4.0.2.8

OpenBSD OpenSSH: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line…

• OpenBSD OpenSSH
• CWE-1284

FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment

• FOSSBilling
• CWE-754
• CWE-1284

ASUS AI Suite 3: ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the…

• ASUS AI Suite 3
• CWE-1284

ASUS AI Suite 3: ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the…

• ASUS AI Suite 3
• CWE-1284

TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

• Erlang OTP
• CWE-1284

WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

• BoldGrid W3 Total Cache
• CWE-1284

IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user

• IBM Db2
• CWE-1284

WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability

• Cory Marsh BitFire Security
• CWE-1284

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

• CWE-20
• CWE-1284

<14.14.0 · fixed in 14.14.0

Devolutions Server: Improper input validation in the PAM AD discovery endpoints in Devolutions Server…

• Devolutions Server
• CWE-1284

GnuPG: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles…

• GnuPG
• CWE-1284

GNU libidn: GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the…

• GNU libidn
• CWE-1284

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

• CWE-20
• CWE-1284

>=4.0.0, <4.11.2 || >=5.0.0, <5.6.5 · fixed in 4.11.2, 5.6.5

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

• Denial of service
• CWE-1284

<11.4.3 · fixed in 11.4.3

NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size

• nilfs-dev nilfs-utils
• CWE-1284

OpenBSD: sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication…

• OpenBSD
• CWE-1284

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

• CWE-1284

<0.0.31 · fixed in 0.0.31

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability

• WP Swings Upsell Order Bump Offer for WooCommerce
• CWE-1284

WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

• WP Travel Engine
• CWE-1284

WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability

• Magepeople inc. WpEvently
• CWE-1284

WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability

• Wasiliy Strecker Contest Gallery
• CWE-1284

File Browser has a DoS Vulnerability via Public Login API

• Denial of service
• CWE-1284

<=1.11.0 · no fixed version yet

Cellopoint｜CelloOS - Improper Access Control

• Cellopoint CelloOS
• CWE-1284

ConnectWise ScreenConnect: In ScreenConnect™ versions prior to 26.2…

• ConnectWise ScreenConnect
• CWE-1284

sahlberg libnfs: libnfs through 6.0.2 before 55c18ea does not validate a string size…

• sahlberg libnfs
• CWE-1284

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

• ShapedPlugin, LLC Product Slider Pro for WooCommerce
• CWE-1284

ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

• CWE-1284

>=2.10.0, <4.39.0 · fixed in 4.39.0

Incorrect validation of field size in Ubuntu Linux AppArmor notification responses

• Canonical Ubuntu Linux
• CWE-1284

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

• CWE-1284

<26.6.3 · fixed in 26.6.3

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

• CWE-1284

<26.6.3 · fixed in 26.6.3

Open BMC Denial of Service

• IBM OPENBMC
• CWE-1284

crypto: authencesn - reject short ahash digests during instance creation

• Linux kernel
• CWE-1284

There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.

• IBM Cloud APM, Base Private
• IBM Cloud APM, Advanced Private
• CWE-1284

WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability

• Ads by WPQuads
• CWE-1284

WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability

• Ads by WPQuads
• CWE-1284

Out-of-bounds Write in CODESYS Control

• CODESYS Control RTE (SL)
• CODESYS Control RTE (for Beckhoff CX) SL
• CWE-1284

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

• CWE-1284

<0.52.0 · fixed in 0.52.0

Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service

• Ledger Nano X
• Ledger Flex
• CWE-1284

iskorotkov/avro: CPU Exhaustion in Decoder

• Denial of service
• CWE-1284

<2.33.0 · fixed in 2.33.0

iskorotkov/avro: Integer Overflow in Decoder

• Memory corruption
• CWE-681

<2.33.0 · fixed in 2.33.0

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

• Denial of service
• CWE-1284

<2.33.0 · fixed in 2.33.0

Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals

• givanz Vvveb
• CWE-1284