AISLE CVE Discoveries

Integer overflow in SplashOutputDev::tilingPatternFill leading to heap buffer overflow

Command injection in initialize_kerberos_keytab_file_login()

Stored XSS in the prescription multi-print view via patient demographic fields

Broken sensitivity check lets restricted users view sensitive group encounters

Stored DOM XSS in the portal signer modal via unsanitized patient names

Stored XSS in the CCDA document preview via unsanitized linkHtml attributes

Out-of-bounds write in avrc_vendor_msg() when handling AVRCP vendor commands

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

Stack-based Buffer Overflow in Wireshark

Unauthenticated DoS in via unbounded request body read

Unauthenticated DoS in `/ipa/migration/migration.py` via unbounded request body read

Unbounded peer-controlled json parameters enables remote denial of service via resource exhaustion

Unauthenticated disclosure of the Active Directory default join password via adInfo()

Unbounded memory request in AcquireAlignedMemory leading to out-of-memory condition

Missing check in the DCM decoder allows images with invalid dimensions, causing crashes

Stack buffer overflow verifying EdDSA PGP signatures with mismatched MPI lengths

NULL pointer dereference during OCSP chain checking with partial-chain verification

Denial of service via duplicate sequence numbers in DTLS packet reordering

NULL pointer dereference in mod_dav_lock via a malicious request

Unvalidated Telegram webhook secret allows forged updates that bypass sender allowlists

NULL pointer dereference when processing CMS KeyTransportRecipientInfo

NULL pointer dereference when processing CMS KeyAgreeRecipientInfo

NULL pointer dereference when processing a delta CRL missing the CRL Number extension

Out-of-bounds read when processing partial AES-CFB128 blocks on AVX-512 systems

Pre-authentication memory exhaustion via a WebSocket compression bomb

Improper array index validation in the PostgreSQL protocol parser causing a panic

Webhook authentication bypass in the BlueBubbles plugin via loopback address trust

Cross-board IDOR in checklist deletion via unverified cardId-to-board relationship

Cross-board IDOR in checklist creation via unverified cardId-to-board relationship

Missing object relationship validation in the attachment upload API

Double free in fz_fill_pixmap_from_display_list() error handling during barcode decoding

Session timeout bypass via the skip_timeout_reset parameter

SQL injection in apidoc queue insertion via an unescaped filename

Predictable verification hashes in election account requests

Unauthenticated SSRF in getversion.php via the url parameter

SSRF protection bypass via address ranges missing from the local IP denylist

Unauthenticated resource exhaustion via stalled ACME TLS-ALPN handshakes

Missing connection throttling in the system-mode RDP listener allows unauthenticated DoS

Connection reuse ignores changed client certificate and private key TLS options

Command injection via crafted DHCP options allows root code execution in the initramfs

Certificate chain verification bypass in PKCS7_verify() with multiple signers

Local file exposure allows any user to read internal system files

Unhandled exception in the WebSocket client via an out-of-range server_max_window_bits

Stack memory disclosure to the DNS resolver in getnetbyaddr and getnetbyaddr_r

Denial of service via malformed payloads in the Graphite, Zookeeper, and Prometheus metricsets

NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() on malformed PKCS#12 files

Type confusion in TS_RESP_verify_response() causing a NULL pointer dereference