AISLE CVE Discoveries

Integer wraparound undersizes allocations, letting unprivileged users write out of bounds

Privilege escalation to administrator via unvalidated usergroup role assignments

Improper access control in the fixDuplicateLists admin repair method

Memory corruption when processing crafted web content leading to a process crash

Arbitrary kernel memory read and write via ltq-ptm driver ioctls

Stack buffer overflow via an oversized AEAD IV in CMS (Auth)EnvelopedData parsing

Shell command injection by a malicious server via DNS variables with --dns-updown

Uncontrolled Resource Consumption in XmlTreeBuilder

Stack exhaustion via uncontrolled recursion when applying crafted JSON Patch documents

Payment total tampering via fail-open get_calc_value() in ListSelect and ListRadio fields

Infinite loop in rtp_asf_fix_header() via an undersized ASF chunksize

Stored XSS in the patient portal payment flow executing in staff browsers

Unbounded PGP AEAD chunk size allows pre-authentication resource exhaustion

2FA Bypass via Remember-Me Cookie

Integer overflow in remote message decompression crashes the CIB remote listener

Out-of-bounds write in bta_dm_sdp_result() when SDP discovery returns more than 32 services

FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing

Integer overflow in the memalign function family leading to heap corruption

Exponential runtime in cJSON_Compare() on deeply nested JSON, leading to denial of service

Unauthenticated deletion of host AES keys and power schedules via clearAES and clearPMTasks

Certificate validation falls back to Common Name checks on an oversized SAN

Heap overread in RSA key exchange with a PKCS#11-backed key via a short premaster secret

Integer underflow leading to out-of-bounds access in wc_XChaCha20Poly1305_Decrypt()

Heap-based Buffer Overflow in Wireshark

FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

Authorization bypass exposes stored routine definitions to role-granted EXECUTE users

Heap buffer overflow in dhclient's environment array resizing via a crafted packet

dhclient.conf directive injection via the BOOTP file field, leading to root code execution

IDOR in the patient notes web UI allows modifying and deleting arbitrary notes

Missing authorization lets any user delete procedure orders via handle_deletions.php

Module ACL check in zhAclCheck() ignores explicit deny entries

Inverted ACL check in the CDR ControllerRouter lets any user modify clinical rules

Unvalidated auth.token skips device identity checks in the gateway WebSocket handshake

Use-after-free in client-side DANE TLSA certificate checking

OAuth2 PKCE bypass via unpersisted S256 code_challenge_method during authorization

Out-of-bounds read in the RDPGFX channel via a crafted WIRE_TO_SURFACE_2 PDU

Missing ACL checks on the document and insurance REST API routes

Provider signature forgery via missing authorization in the portal signature endpoint

Heap buffer over-read in wolfSSH_CleanPath() via SCP paths containing '/./' sequences

Integer underflow in WPS Enrollee fragment length handling via truncated EAP-WSC packets

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Heap buffer overflow when decompressing page data from crafted .solv files

Stack buffer overflow in rrdcached via an oversized CREATE request

Stack buffer overflow in libnv via file descriptors exceeding FD_SETSIZE in select()

Buffer over-read and over-write in ngx_http_mp4_module when processing crafted MP4 files

Argument injection in the APT backend via crafted package names leading to root code execution