| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-20203 | Med | 0.35 | 5.3 | 0.02 | Jan 2, 2020 | The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message. | ||
| CVE-2019-20202 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an invalid free and segmentation fault. | ||
| CVE-2019-20201 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur. | ||
| CVE-2019-20200 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature. | ||
| CVE-2019-20199 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer. | ||
| CVE-2019-20198 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file. | ||
| CVE-2015-5595 | Med | 0.45 | 6.5 | 0.01 | Dec 31, 2019 | Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption). | ||
| CVE-2015-5593 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "payload", or in an image tag,… | ||
| CVE-2015-5592 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| CVE-2015-5591 | Hig | 0.50 | 7.2 | 0.02 | Dec 31, 2019 | SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands. | ||
| CVE-2019-18568 | Hig | 0.57 | 8.8 | 0.01 | Dec 31, 2019 | Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user. | ||
| CVE-2013-7071 | Med | 0.33 | 6.1 | 0.01 | Dec 31, 2019 | Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | ||
| CVE-2013-7070 | Cri | 0.57 | 9.8 | 0.04 | Dec 31, 2019 | The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI. | ||
| CVE-2011-3585 | Med | 0.31 | 4.7 | 0.00 | Dec 31, 2019 | Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists. | ||
| CVE-2004-2776 | Cri | 0.64 | 9.8 | 0.04 | Dec 31, 2019 | go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter. | ||
| CVE-2019-20197 | Hig | 0.59 | 8.8 | 0.23 | Dec 31, 2019 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account. | ||
| CVE-2013-4357 | Hig | 0.49 | 7.5 | 0.03 | Dec 31, 2019 | The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. | ||
| CVE-2013-4161 | Hig | 0.51 | 7.8 | 0.00 | Dec 31, 2019 | gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue. | ||
| CVE-2019-3984 | Cri | 0.64 | 9.8 | 0.04 | Dec 31, 2019 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet. | ||
| CVE-2019-14466 | Med | 0.42 | 6.5 | 0.01 | Dec 31, 2019 | The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize… | ||
| CVE-2019-10227 | Med | 0.43 | 6.1 | 0.01 | Dec 31, 2019 | openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component. | ||
| CVE-2019-9668 | Hig | 0.49 | 7.5 | 0.02 | Dec 31, 2019 | An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service (daemon crash) via a 0xffff datalen field value. | ||
| CVE-2019-9556 | Med | 0.38 | 5.4 | 0.01 | Dec 31, 2019 | FiberHome an5506-04-f RP2669 devices have XSS. | ||
| CVE-2019-9554 | Med | 0.43 | 6.1 | 0.04 | Dec 31, 2019 | In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. | ||
| CVE-2019-9553 | Med | 0.43 | 6.1 | 0.02 | Dec 31, 2019 | Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933. | ||
| CVE-2019-9207 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinued. | ||
| CVE-2019-9206 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued. | ||
| CVE-2019-9197 | Hig | 0.57 | 8.8 | 0.04 | Dec 31, 2019 | The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. | ||
| CVE-2019-7751 | Hig | 0.53 | 7.5 | 0.14 | Dec 31, 2019 | A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for… | ||
| CVE-2019-12837 | Med | 0.28 | 4.3 | 0.01 | Dec 31, 2019 | The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints. | ||
| CVE-2018-19834 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2019 | The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. | ||
| CVE-2018-19833 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2019 | The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. | ||
| CVE-2018-19832 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2019 | The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. | ||
| CVE-2018-19831 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2019 | The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. | ||
| CVE-2018-19830 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2019 | The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public (by default) and does not check the caller's… | ||
| CVE-2018-14476 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. | ||
| CVE-2019-7162 | Cri | 0.59 | 9.1 | 0.04 | Dec 31, 2019 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation. | ||
| CVE-2019-20176 | Hig | 0.49 | 7.5 | 0.04 | Dec 31, 2019 | In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. | ||
| CVE-2019-12273 | Med | 0.42 | 6.5 | 0.00 | Dec 31, 2019 | OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The vendor claims that the independent… | ||
| CVE-2019-12186 | Med | 0.31 | 4.8 | 0.01 | Dec 31, 2019 | An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through… | ||
| CVE-2019-10229 | Hig | 0.57 | 8.8 | 0.01 | Dec 31, 2019 | An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password… | ||
| CVE-2019-20175 | Hig | 0.49 | 7.5 | 0.03 | Dec 31, 2019 | An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a… | ||
| CVE-2019-20172 | Hig | 0.51 | 7.8 | 0.00 | Dec 31, 2019 | Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack. | ||
| CVE-2019-7479 | Hig | 0.47 | 7.2 | 0.01 | Dec 31, 2019 | A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n,… | ||
| CVE-2019-19927 | Med | 0.39 | 6.0 | 0.01 | Dec 31, 2019 | In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related… | ||
| CVE-2019-7478 | Cri | 0.64 | 9.8 | 0.01 | Dec 31, 2019 | A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1. | ||
| CVE-2019-20171 | Med | 0.36 | 5.5 | 0.01 | Dec 31, 2019 | An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c. | ||
| CVE-2019-20170 | Med | 0.36 | 5.5 | 0.01 | Dec 31, 2019 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c. | ||
| CVE-2019-20169 | Med | 0.36 | 5.5 | 0.01 | Dec 31, 2019 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function trak_Read() in isomedia/box_code_base.c. | ||
| CVE-2019-20168 | Med | 0.36 | 5.5 | 0.01 | Dec 31, 2019 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function gf_isom_box_dump_ex() in isomedia/box_funcs.c. |
- risk 0.35cvss 5.3epss 0.02
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file.
- risk 0.45cvss 6.5epss 0.01
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).
- risk 0.40cvss 6.1epss 0.01
The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "payload", or in an image tag,…
- risk 0.40cvss 6.1epss 0.01
Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.
- risk 0.50cvss 7.2epss 0.02
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
- risk 0.57cvss 8.8epss 0.01
Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
- risk 0.57cvss 9.8epss 0.04
The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI.
- risk 0.31cvss 4.7epss 0.00
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.
- risk 0.64cvss 9.8epss 0.04
go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.
- risk 0.59cvss 8.8epss 0.23
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
- risk 0.49cvss 7.5epss 0.03
The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.
- risk 0.51cvss 7.8epss 0.00
gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue.
- risk 0.64cvss 9.8epss 0.04
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.
- risk 0.42cvss 6.5epss 0.01
The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize…
- risk 0.43cvss 6.1epss 0.01
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service (daemon crash) via a 0xffff datalen field value.
- risk 0.38cvss 5.4epss 0.01
FiberHome an5506-04-f RP2669 devices have XSS.
- risk 0.43cvss 6.1epss 0.04
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
- risk 0.43cvss 6.1epss 0.02
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.
- risk 0.40cvss 6.1epss 0.01
PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinued.
- risk 0.40cvss 6.1epss 0.01
PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.
- risk 0.57cvss 8.8epss 0.04
The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
- risk 0.53cvss 7.5epss 0.14
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for…
- risk 0.28cvss 4.3epss 0.01
The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.
- risk 0.49cvss 7.5epss 0.01
The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
- risk 0.49cvss 7.5epss 0.01
The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
- risk 0.49cvss 7.5epss 0.01
The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
- risk 0.49cvss 7.5epss 0.01
The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
- risk 0.49cvss 7.5epss 0.01
The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public (by default) and does not check the caller's…
- risk 0.40cvss 6.1epss 0.01
GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
- risk 0.59cvss 9.1epss 0.04
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
- risk 0.49cvss 7.5epss 0.04
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
- risk 0.42cvss 6.5epss 0.00
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The vendor claims that the independent…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through…
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password…
- risk 0.49cvss 7.5epss 0.03
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a…
- risk 0.51cvss 7.8epss 0.00
Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
- risk 0.47cvss 7.2epss 0.01
A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n,…
- risk 0.39cvss 6.0epss 0.01
In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related…
- risk 0.64cvss 9.8epss 0.01
A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function trak_Read() in isomedia/box_code_base.c.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function gf_isom_box_dump_ex() in isomedia/box_funcs.c.