Cipher-Creator

An SQL injection issue exists in the Fee Sheet drug-inventory lookup within the `sellDrug()` function of the `DrugSalesService` class. The flaw occurs when the `prod[N][warehouse]` POST field is interpolated into an ORDER BY clause. Low-privileged authenticated users can exploit this by submitting Fee Sheet product lines containing constant subqueries to perform a time-based blind oracle attack, allowing the extraction of patient data and `users secure` bcrypt hashes.

A VideoStreaming interface reports the size of its class-specific descriptor block in the `wTotalLength` field of its input header. The host uses this value as the budget for processing format, frame, and frame-interval descriptors without verifying it against the actual configuration descriptor received. If a device reports a `wTotalLength` larger than the descriptors it provides, the host continues dereferencing the cursor past the end of the configuration buffer when the application queries format or frame data.

A heap out-of-bounds read occurs during ordinary enumeration when a HID peripheral returns a short report descriptor. The USBX host processes the report descriptor sequence by advancing over headers and parsing payloads, but it only verifies if an item fits in the descriptor after the header has been processed and the payload parsed. Furthermore, the analysis does not validate the declared sizes against the actual bytes received.

During the first DTLS ClientHello, the parser copies a device-claimed `session id` length and validates the ciphersuite-list length against the total record length rather than the remaining bytes. This allows an unauthenticated peer to trigger an Out-of-Bounds (OOB) source read of up to 255 bytes. These bytes are then echoed verbatim into the outgoing ServerHello, resulting in the disclosure of adjacent process memory over the network. A variant of this issue can also cause a crash upon receiving the first packet.

A flaw exists where a user can employ a where clause on a table computed field that returns `SETOF some table` to infer row values. This occurs even when those rows should be filtered based on the row-level permissions of `some table`. Although the rows cannot be returned directly, string predicates allow values to be brute forced by using the where clause as an oracle, which is a technique used to extract data by observing the application's response to specific queries.

A stack out-of-bounds write occurs in the single-byte branch of the `spell soundfold sofo()` function within `src/spell.c`. When a SOFO-based spell language is active, the copy loop translates a word using a sound-folding (SOFO) byte map into a caller-owned result buffer. Because the output index `ri` advances without an upper bound and only terminates on the input NUL, any word longer than the `MAXWLEN`-element stack buffer will write past the buffer's end. This corrupts the call frame and causes the editor to crash. This issue can be triggered when a word exceeding `MAXWLEN` is passed to `soundfold()` or reached via sound-based spell suggestions.

The `get text props()` function in `src/textprop.c` reads a `uint16` property count stored inline after a line's text and returns it as the number of 32-byte `textprop T` entries that follow. Because the count is not verified against the actual amount of data present, a line declaring a large count with minimal data can cause the system to read beyond the end of the line buffer. This issue can be triggered via a crafted undo file, resulting in a crash.

The `dump prefixes()` function in src/spell.c iteratively walks a spell-file prefix trie using a depth counter to dump prefixes applying to a word. Because the counter is not checked against the size of the fixed MAXWLEN-element stack arrays it indexes (`prefix[]`, `arridx[]`, and `curi[]`), a specially crafted .spl file can cause the descent to go arbitrarily deep. This results in a stack out-of-bounds write, which corrupts the call frame and causes the editor to crash.

A Vimscript code injection issue exists in the `s:NetrwLocalRmFile()` function within the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. The problem occurs because a filename from the buffer's directory listing is interpolated into an Ex command line passed to `:execute` with only the backslash character escaped. An attacker can use a crafted filename containing a bar (|) character to terminate the intended command and execute arbitrary Vimscript, which may include shell commands via `:call system()` and `:!`.

When opening a file encrypted using the VimCrypt~04! or VimCrypt~05! methods (which utilize xchacha20poly1305 and require the +sodium feature), an unsigned length calculation underflows if the file body is shorter than a single libsodium secretstream header. This leads to a decryption call that reads beyond the end of the input buffer, resulting in a crash of the application.

The `tree count words()` function in src/spellfile.c fails to validate a depth counter against the size of fixed MAXWLEN-element stack arrays, specifically `arridx[]`, `curi[]`, and `wordcount[]`. A specially crafted .spl/.sug file pair can trigger an arbitrarily deep descent during spell suggestion, resulting in a stack out-of-bounds write. This memory corruption affects the call frame and leads to an application crash.