Brian Gorenc

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V13.2 Teamcenter Visualization versions prior to V13.2 Description: A vulnerability has been identified in the BMP Loader.dll library, which lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an allocated buffer, allowing an attacker to leak information in the context of the current process. Recommendations: For JT2Go versions prior to V13.2, update to version V13.2 or later to resolve the issue. For Teamcenter Visualization versions prior to V13.2, update to version V13.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the BMP Loader.dll library until a patch is available.

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V13.2 Teamcenter Visualization versions prior to V13.2 Description: A vulnerability has been identified in the Tiff Loader.dll library, which lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. Recommendations: For JT2Go versions prior to V13.2, update to version V13.2 or later to resolve the issue. For Teamcenter Visualization versions prior to V13.2, update to version V13.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Tiff Loader.dll library until a patch is available.

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V13.2 Teamcenter Visualization versions prior to V13.2 Description: A vulnerability has been identified in the BMP Loader.dll library, which lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition, allowing an attacker to execute code in the context of the current process. Recommendations: For JT2Go versions prior to V13.2, update to version V13.2 or later to resolve the issue. For Teamcenter Visualization versions prior to V13.2, update to version V13.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the BMP Loader.dll library until a patch is available.

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V13.2 Teamcenter Visualization versions prior to V13.2 Description: A vulnerability has been identified in the Gif loader.dll library, which lacks proper validation of user-supplied data when parsing GIF files. This could result in an out of bounds write past the end of an allocated structure, allowing an attacker to execute code in the context of the current process. Recommendations: For JT2Go versions prior to V13.2, update to version V13.2 or later to resolve the issue. For Teamcenter Visualization versions prior to V13.2, update to version V13.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of GIF files in the affected applications until a patch is available.

A use-after-free issue exists in the DGN file-reading procedure due to the lack of proper validation of user-supplied data. This can result in memory corruption or arbitrary code execution, allowing attackers to cause a denial-of-service condition or execute code in the context of the current process.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup TimeRange` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup JobList` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackup JobList` method until a patch is available to prevent exploitation. Restrict access to the SQL queries constructed by this method to minimize the risk of code execution. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup versions 11.3.0.12 Description: The issue is related to insufficient protection of the SQL query structure in the NVBUJobHistory Get method. This allows a remote attacker to execute arbitrary code by leveraging the lack of proper validation of a user-supplied string used to construct SQL queries. The attacker can execute code in the context of the underlying database. No authentication is required to exploit this issue. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the NVBUJobHistory Get method until a patch is available to prevent remote code execution. Restrict access to the underlying database to minimize the risk of exploitation. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackupOptionSet` Get method requests, due to the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackupOptionSet` Get method until a patch is available to prevent exploitation. Restrict access to the SQL queries to minimize the risk of code execution. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup version 11.3.0.12 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of `NVBUBackup ClientList` method requests, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of the underlying database. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the `NVBUBackup ClientList` method until a patch is available to prevent exploitation. Restrict access to the SQL queries constructed by this method to minimize the risk of code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Quest NetVault Backup versions 11.3.0.12 Description: The issue is related to insufficient protection of the SQL query structure in the NVBUBackup PluginList method. This allows a remote attacker to execute arbitrary code by leveraging the lack of proper validation of a user-supplied string used to construct SQL queries. The attacker can execute code in the context of the underlying database. No authentication is required to exploit this issue. Recommendations: For Quest NetVault Backup version 11.3.0.12, consider disabling the NVBUBackup PluginList method as a temporary workaround until a patch is available. Restrict access to the underlying database to minimize the risk of exploitation. Avoid using user-supplied strings in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. This can be exploited to cause a Denial of Service.

The issue concerns SQL injection vulnerability in the Ecava IntegraXor web server. Specifically, parameters are not properly sanitized, which could allow an attacker to execute read, write, and delete commands on the host's database. The `getdata` parameter is mentioned as being vulnerable to SQL injection, potentially leading to remote code execution.

A heap-based buffer overflow issue allows remote attackers to execute arbitrary code via a crafted file.

A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a crafted file.

The issue is related to a use-after-free vulnerability, which occurs when memory is accessed after it has been freed. This can allow a remote attacker to execute arbitrary code.

The issue is caused by a buffer overflow and a use-after-free vulnerability in Adobe Reader and Acrobat, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted FileAttachment note.

The issue is caused by a buffer overflow and memory corruption, allowing a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted set of fields.

The issue is caused by a buffer overflow in the dynamic memory of the Tivoli Storage Manager FastBack program. This can be exploited by a remote attacker using a specially crafted packet, potentially allowing the execution of arbitrary code.

The issue is related to the lack of input data sanitization in the Tivoli Storage Manager FastBack program, allowing remote attackers to execute arbitrary commands. This can be achieved through unspecified vectors.