Fatullayev Asadbek

**Name of the Vulnerable Software and Affected Versions** rlottie versions prior to 8de0d9e6ca80ffef654965505981727b9fa06a51 **Description** An uncontrolled recursion issue exists in Samsung Open Source rlottie, which allows the processing of serialized data containing nested payloads. Uncontrolled recursion occurs when a function calls itself repeatedly without a proper termination condition, potentially leading to a stack overflow and system crash. **Recommendations** Update rlottie to version 8de0d9e6ca80ffef654965505981727b9fa06a51 or later.

**Name of the Vulnerable Software and Affected Versions** CodeChecker versions prior to 6.28.3 **Description** A stack overflow occurs during the invocation of the `safe strcpy()` helper function within the `ldlogger-tool-gcc.c` file. The issue arises because the function uses `strncpy()`, which NUL-pads the destination buffer to the full size of `PATH MAX` (4096 bytes). However, the destination pointer is offset by 2 bytes (`fullPath + 2`), leaving only 4094 bytes of available space. This results in a 2-byte overflow on every invocation, regardless of the input path length. **Recommendations** Update to version 6.28.3 or later.

**Name of the Vulnerable Software and Affected Versions** bcg729 versions prior to 1.1.3 **Description** An out-of-bounds read exists in the `decodeSIDframe()` function within `src/cng.c`. Unauthenticated network-adjacent attackers can trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. This occurs because a zero-length payload causes an integer underflow in the `uint8 t` filter order calculation, which wraps to 255 and is clamped to 10. Consequently, the function reads 11 bytes from a zero-byte buffer, leading to media process termination or the silent consumption of adjacent heap memory as reflection coefficients. **Recommendations** Update to a version newer than 1.1.2. As a temporary workaround, restrict the use of the `decodeSIDframe()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** COVESA Open1722 versions 0.1722 through 0.9.2 **Description** An integer truncation issue exists in acf-can-listener.c. Unauthenticated remote attackers can cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The `num can msgs` variable, declared as uint8 t, truncates the -1 error return value from the `avtp to can()` function to 255. This causes a write loop to iterate 255 times over a 15-slot stack array, leaking approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TIER IV Nebula versions prior to 1.2.1 **Description** An out-of-bounds read exists in the `Vlp32Decoder::unpack()` function. This allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. By sending a malformed datagram to the Velodyne UDP sensor port, which lacks the sender-address restrictions found in other drivers, attackers can cause fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes. **Recommendations** Update TIER IV Nebula to a version newer than 1.2.0. As a temporary workaround, restrict access to the Velodyne UDP sensor port to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** COVESA Open1722 versions 0.1722 through 0.9.2 **Description** A stack buffer overflow occurs when unauthenticated remote attackers send a crafted UDP datagram containing more than 15 ACF-CAN messages. The `avtp to can()` function increments its write index without bounding it against the caller-supplied array size. Since the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory, potentially leading to arbitrary code execution or denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** indiserver versions prior to 2.2.4.3 **Description** A stack buffer overflow occurs when the daemon processes malformed XML with mismatched tags exceeding 1024 bytes. An unauthenticated remote attacker can send a single TCP packet on port 7624 to trigger an unbounded `sprintf()` write into a fixed 1024-byte stack buffer within `MsgQueue.cpp`. This action terminates the daemon and disrupts all active client and driver sessions. **Recommendations** Update indiserver to the version containing commit 96bbd7f.

**Name of the Vulnerable Software and Affected Versions** Juggle versions prior to 1.6.0 **Description** Unauthenticated remote attackers can execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected '/h2-console' endpoint and leverage the H2 CREATE ALIAS `Runtime.exec()` technique to execute commands, which results in root-level code execution when using the stock Docker image. **Recommendations** Update to version 1.6.0 or later. Restrict access to the '/h2-console' endpoint. Change the default shipped credentials for the H2 database web console.

**Name of the Vulnerable Software and Affected Versions** Spikster versions prior to commit e1cdf8c **Description** A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the `CipiAuth` middleware is registered but not applied to any route within the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users. **Recommendations** Update Spikster to a version including commit e1cdf8c or later.