Vulnerabilities

The network messaging layer contained improper handling of highly compressed data affecting service availability.

QAPI contained a stack-based buffer overflow affecting service availability.

MediaAgent contained a heap-based buffer overflow issue affecting service availability.

CVFS contained an input validation issue affecting command execution.

CVFS contained a missing authentication condition affecting command execution.

CvFWD contained a null pointer dereference affecting service availability.

CvFWD contained an out-of-bounds write affecting service availability.

CvFWD contained an integer overflow affecting service availability.

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.

HyperScale contained a path traversal issue affecting information disclosure.

Cvlaunchd contained a missing authorization issue affecting command execution authorization.

CommServe contained a cryptographic signature verification issue affecting privilege management.

CommServe contained a path traversal issue affecting information disclosure.

CommServe contained an authentication bypass issue affecting access authorization and information disclosure.

CommServe contained a heap-based buffer overflow issue affecting service availability.

CommServe contained a stack-based buffer overflow issue affecting service availability.

Private Metrics Server contained an SQL injection condition affecting database operations.

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability.

Content Extractor contained a deserialization of untrusted data issue affecting privilege management.

DataCube contained a path traversal issue affecting security feature enforcement.

Command Center API contained an authentication bypass issue affecting privilege management.

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations.

CommServe contained an allowlist bypass vulnerability affecting command execution authorization.

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs.

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack.