CVE-2026-42450

creationtimestamp| type| source ---|---|--- 2026-06-24 22:02:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2w64k4ye2c...

CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer4096, so a crafted .spi3d file can overflow by 4000 bytes on...

CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer4096, so a crafted .spi3d file can overflow by 4000 bytes on...

DEBIAN-CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer4096, so a crafted .spi3d file can overflow by 4000 bytes on...

SUSE CVE-2026-42450

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer4096, so a crafted .spi3d file can overflow by 4000 bytes on...

CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2022-42450

Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications...

CVE-2022-42450

Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications...

CVE-2022-42450

creationtimestamp| type| source ---|---|--- 2025-04-30 22:14:28+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14188 2025-05-01 01:56:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo37f5jten2e 2025-05-01 02:17:31+00:00| seen| https://t.me/cvedetector/24172...

CVE-2022-42450

CVE-2022-42450 concerns HCL Domino Volt. The issue is improper sanitization of SVG files in deployed Domino Volt applications, enabling client-side script injection (XSS) via SVG content. Documents specify CVSS base scores (NVD: 5.4/ MEDIUM; with UI:R, S:C, etc.; user interaction required) but do...

CVE-2024-42450

creationtimestamp| type| source ---|---|--- 2024-11-21 11:23:38+00:00| seen| https://t.me/CyberBulletin/26535 2024-11-21 11:23:38+00:00| seen| https://t.me/CyberBulletin/1557...

CVE-2023-42450

creationtimestamp| type| source ---|---|--- 2023-09-19 20:34:36+00:00| seen| https://t.me/cibsecurity/70743 2023-10-23 05:11:12+00:00| published-proof-of-concept| https://t.me/CNArsenal/1341 2023-10-23 10:58:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9247...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450

Mastodon (ActivityPub-based) is affected in versions up to 4.2.0-rc2 where crafting specific input can inject arbitrary data into HTTP requests issued by the server. The issue enables confused deputy attacks if ALLOWED_PRIVATE_ADDRESSES permits access to local exploitable services. A patch exists...