List of Known Vulnerabilities in Qt Products
Security Advisories in Qt Products
| Product | CVE | Description | Impact | Affected Versions | Fixed Versions | More Info |
|---|---|---|---|---|---|---|
| Axivion |
Inherited Apache Tomcat vulnerability (fixed in Tomcat 11.0.26) via the Dashboard's bundled Tomcat
|
Remote privilege escalation: an unauthorized user may execute requests as a Dashboard Administrator
|
Dashboard 7.12.1–7.12.5, 7.11.7–7.11.8 | 7.11.9, 7.12.6, 7.13.0 or later | ||
| Axivion |
CWE-862 Missing Authorization in Dashboard OAuth/OIDC implementation
|
Any OIDC/OAuth-authenticated user can become Dashboard Administrator; chained with another weakness, arbitrary code execution on the host as the Dashboard OS user
|
7.8.5–7.8.12, 7.9.0–7.9.12, 7.10.0–7.10.10, 7.11.0–7.11.6, 7.12.0–7.12.1 | 7.9.13, 7.10.11, 7.11.7, 7.12.2 or later | ||
| Axivion |
CWE-601 Open Redirect in Dashboard OAuth/OIDC implementation
|
A crafted login link can send users to an attacker site after genuine login; usable for phishing (credential/2FA theft)
|
7.8.0–7.8.12, 7.9.0–7.9.12, 7.10.0–7.10.10, 7.11.0–7.11.6, 7.12.0–7.12.1 | 7.9.13, 7.10.11, 7.11.7, 7.12.2 or later | ||
| Qt Framework |
Out-of-bounds read in CoAP message parsing
|
Malformed CoAP message can crash the app or cause it to work on incorrect data
|
5.13.0–6.8.8, 6.9.0–6.11.2 | 6.8.9 LTS, 6.11.3, 6.12.0 | ||
| Qt Framework |
Integer overflow in Qt5Compat XML parsing
|
Crafted XML may cause incorrect memory handling; worst case crash (DoS) or data corruption
|
6.0–6.8.9, 6.9.0–6.11.2, 6.12.0 | 6.8.10, 6.11.3, 6.12.1 | ||
| Qt Framework |
Memory corruption in QMqttClient
|
Certain MQTT 5 connection settings can corrupt memory and crash the app
|
5.12.0–6.8.8, 6.9.0–6.11.2 | 6.8.9, 6.11.3, 6.12.0 | ||
| Qt Framework |
NULL pointer dereference in QCborValue to JSON conversion
|
Untrusted CBOR converted to JSON can crash the app (DoS); other memory-safety effects possible depending on compiler
|
5.12.0–6.8.9, 6.9.0–6.11.2, 6.12.0 | 6.8.10, 6.11.3, 6.12.1 | ||
| Qt Framework |
Out-of-bounds read in NTLM authentication handling
|
Malicious server/proxy can trigger heap memory disclosure and possible termination
|
6.8.0–6.8.9, 6.9.0–6.11.1 (status unknown before 6.8.0) | 6.8.10, 6.11.2, 6.12.0 | ||
| Qt Framework |
Out-of-bounds write in QTextCodec iconv-based encoding
|
Encoding may write past an internal buffer: crash, possible integrity impact
|
4.5.0–6.8.8, 6.9.0–6.11.2 | 6.8.9, 6.11.3, 6.12.0 | ||
| Qt Framework |
Out-of-bounds read in QTextCodec TSCII encoding
|
Converting to TSCII may read past input buffer: crash or misinterpreted data
|
4.0.0–6.8.8, 6.9.0–6.11.2 | 6.8.9, 6.11.3, 6.12.0 |
No results found