Nvidia

NVIDIA NeMo Agent Toolkit is vulnerable to a SQL injection flaw that may allow an unauthorized attacker to perform data tampering, cause a denial of service, or facilitate unauthorized information disclosure.

NVIDIA TensorRT-LLM contains an improper tokenizer loading vulnerability that could allow an attacker to achieve remote code execution, information disclosure, data tampering, or denial of service by influencing the control sphere.

NVIDIA PhysX for all platforms contains an out-of-bounds write vulnerability that could lead to code execution, data tampering, denial of service, or information disclosure.

A logic flaw in OpenBMC's phosphor-net-ipmid implementation allows authenticated remote attackers to hijack existing sessions and perform unauthorized privilege escalation.

Local attackers can exploit multiple vulnerabilities in Nvidia GPU display drivers to execute arbitrary code, disclose sensitive information, or trigger a denial-of-service condition.

The MONAI library contains a hardcoded insecure deserialization vulnerability in NumpyReader, allowing arbitrary code execution when processing malicious .npy or .npz files.

FFmpeg versions 4.4 through 8.1.2 are vulnerable to a double-free condition within the NVIDIA NVDEC hardware decoder component (libavcodec/nvdec.c), allowing attackers to trigger memory corruption by providing a specially crafted video file, which occurs when an error path frees memory via `nvdec_fdd_priv_free` due to no decoder surfaces remaining, and a subsequent layer attempts to free the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware acceleration.

Multiple vulnerabilities in Nvidia GPU Display Drivers allow a local attacker to escalate privileges, manipulate data, disclose information, cause a denial of service, or execute code.

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook versions 7.0.0 through 7.5.5 and JupyterLab versions up to 4.5.6 allows attackers to steal authentication tokens by tricking users into interacting with malicious notebook files, leading to complete account takeover via the Jupyter REST API.

Detection of unsigned or untrusted DLLs being loaded into the LSASS process, which is indicative of credential access attempts by adversaries aiming to steal sensitive information such as user passwords.

Modification of the AppInit DLLs registry keys on Windows systems allows attackers to execute code in every process that loads user32.dll, establishing persistence and potentially escalating privileges.

Detection of LSASS loading an unsigned or untrusted DLL, which can indicate credential access attempts by malicious actors targeting sensitive information stored in the LSASS process.