Brian Gorenc

**Nome do software vulnerável e versões afetadas: Versões do JT2Go anteriores à V13.2 Versões do Teamcenter Visualization anteriores à V13.2 Descrição: Foi identificada uma vulnerabilidade na biblioteca BMP Loader.dll, que não realiza a validação adequada dos dados fornecidos pelo usuário ao analisar arquivos BMP. Isso pode resultar em uma leitura fora dos limites, além do fim de um buffer alocado, permitindo que um invasor vaze informações no contexto do processo atual. Recomendações: Para versões do JT2Go anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Para versões do Teamcenter Visualization anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o uso da biblioteca BMP Loader.dll até que um patch esteja disponível.

**Nome do software vulnerável e versões afetadas: Versões do JT2Go anteriores à V13.2 Versões do Teamcenter Visualization anteriores à V13.2 Descrição: Foi identificada uma vulnerabilidade na biblioteca Tiff Loader.dll, que não realiza a validação adequada dos dados fornecidos pelo usuário ao analisar arquivos TIFF. Isso pode resultar em uma leitura fora dos limites, além do fim de um buffer alocado. Um invasor poderia explorar essa vulnerabilidade para vazar informações no contexto do processo atual. Recomendações: Para versões do JT2Go anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Para versões do Teamcenter Visualization anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o uso da biblioteca Tiff Loader.dll até que um patch esteja disponível.

**Nome do software vulnerável e versões afetadas: Versões do JT2Go anteriores à V13.2 Versões do Teamcenter Visualization anteriores à V13.2 Descrição: Foi identificada uma vulnerabilidade na biblioteca BMP Loader.dll, que não realiza a validação adequada dos dados fornecidos pelo usuário ao analisar arquivos BMP. Isso pode resultar em uma condição de corrupção de memória, permitindo que um invasor execute código no contexto do processo atual. Recomendações: Para versões do JT2Go anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Para versões do Teamcenter Visualization anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Como solução temporária, considere restringir o uso da biblioteca BMP Loader.dll até que um patch esteja disponível.

**Nome do software vulnerável e versões afetadas: Versões do JT2Go anteriores à V13.2 Versões do Teamcenter Visualization anteriores à V13.2 Descrição: Foi identificada uma vulnerabilidade na biblioteca Gif loader.dll, que não realiza a validação adequada dos dados fornecidos pelo usuário ao analisar arquivos GIF. Isso pode resultar em uma gravação fora dos limites, além do fim de uma estrutura alocada, permitindo que um invasor execute código no contexto do processo atual. Recomendações: Para versões do JT2Go anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Para versões do Teamcenter Visualization anteriores à V13.2, atualize para a versão V13.2 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o uso de arquivos GIF nos aplicativos afetados até que um patch esteja disponível.

Existe uma vulnerabilidade de uso após liberação (use-after-free) no procedimento de leitura de arquivos DGN devido à falta de validação adequada dos dados fornecidos pelo usuário. Isso pode resultar em corrupção de memória ou execução de código arbitrário, permitindo que invasores causem uma condição de negação de serviço ou executem código no contexto do processo atual.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup TimeRange` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup JobList` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackup JobList` method until a patch is available to prevent exploitation. Restrict access to the SQL queries constructed by this method to minimize the risk of code execution. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup versions 11.3.0.12 Description: The issue is related to insufficient protection of the SQL query structure in the NVBUJobHistory Get method. This allows a remote attacker to execute arbitrary code by leveraging the lack of proper validation of a user-supplied string used to construct SQL queries. The attacker can execute code in the context of the underlying database. No authentication is required to exploit this issue. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the NVBUJobHistory Get method until a patch is available to prevent remote code execution. Restrict access to the underlying database to minimize the risk of exploitation. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackupOptionSet` Get method requests, due to the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackupOptionSet` Get method until a patch is available to prevent exploitation. Restrict access to the SQL queries to minimize the risk of code execution. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup ClientList` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackup ClientList` method until a patch is available to prevent exploitation. Restrict access to the SQL queries constructed by this method to minimize the risk of code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup versions 11.3.0.12 Description: The issue is related to insufficient protection of the SQL query structure in the NVBUBackup PluginList method. This allows a remote attacker to execute arbitrary code by leveraging the lack of proper validation of a user-supplied string used to construct SQL queries. The attacker can execute code in the context of the underlying database. No authentication is required to exploit this issue. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the NVBUBackup PluginList method as a temporary workaround until a patch is available. Restrict access to the underlying database to minimize the risk of exploitation. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. This can be exploited to cause a Denial of Service.

The issue concerns SQL injection vulnerability in the Ecava IntegraXor web server. Specifically, parameters are not properly sanitized, which could allow an attacker to execute read, write, and delete commands on the host's database. The `getdata` parameter is mentioned as being vulnerable to SQL injection, potentially leading to remote code execution.

A heap-based buffer overflow issue allows remote attackers to execute arbitrary code via a crafted file.

A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a crafted file.

The issue is related to a use-after-free vulnerability, which occurs when memory is accessed after it has been freed. This can allow a remote attacker to execute arbitrary code.

The issue is caused by a buffer overflow and a use-after-free vulnerability in Adobe Reader and Acrobat, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted FileAttachment note.

The issue is caused by a buffer overflow and memory corruption, allowing a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted set of fields.

The issue is caused by a buffer overflow in the dynamic memory of the Tivoli Storage Manager FastBack program. This can be exploited by a remote attacker using a specially crafted packet, potentially allowing the execution of arbitrary code.

The issue is related to the lack of input data sanitization in the Tivoli Storage Manager FastBack program, allowing remote attackers to execute arbitrary commands. This can be achieved through unspecified vectors.