Aaron Portnoy

The web fetch tool within TheLibrarians allows retrieval of the Adminer interface content, potentially enabling unauthorized access to the internal TheLibrarian backend system. This allows an attacker to log into the backend.

The Librarian software has an internal port scanning issue stemming from the `web fetch` tool. This tool allows for Server-Side Request Forgery (SSRF)-style behavior, enabling GET requests to internal IP addresses and services. This functionality can be exploited to scan the Hertzner cloud environment used by TheLibrarian. The `web fetch` tool is the component directly involved in this issue.

The issue is a stack-based buffer overflow in the OmniInet.exe component, which is part of the Application Recovery Manager. This occurs when the MSG PROTOCOL command is used with long arguments, allowing remote attackers to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

A remote code execution issue exists in the way Microsoft Office handles specially crafted Rich Text Format (RTF) files. This could allow remote code execution if a user opens a specially crafted RTF file in Word, or reads or previews a specially crafted e-mail sent in the RTF format. An attacker who successfully exploits this issue could take control of an affected system in the context of the currently logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

The issue is related to a heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service, allowing remote attackers to read memory contents and execute arbitrary code via a crafted RPC call. This is due to improper processing of parameters to string APIs.

The issue is related to input validation errors, which could allow remote attackers to execute arbitrary code via unknown vectors.

A heap-based buffer overflow issue exists in the SendChannelData function within wfica.ocx. This allows remote malicious websites to execute arbitrary code by manipulating the `DataSize` parameter to be less than the length of the `Data` buffer.