4885 matches found
PT-2021-20861
Name of the Vulnerable Software and Affected Versions: Orion affected versions not specified Description: A security issue was discovered where a user with Orion map manage rights could store XSS through a text box hyperlink. Recommendations: At the moment, there is no information about a newer...
CVE-2021-35239: Improper Neutralization of Input During Web Page Generation
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink...
GHSA-3VJM-36RR-7QRQ NULL Pointer Dereference in cbox
An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code...
Data race in abox
Affected versions of this crate implements Send/Sync for AtomicBox without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined...
UBUNTU-CVE-2020-18899
An uncontrolled memory allocation in DataBufdatasubBox.length-sizeofbox function of Exiv2 0.27 allows attackers to cause a denial of service DOS via a crafted input...
pdfbox: OutOfMemory-Exception while loading a crafted PDF file
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions...
DEBIAN-CVE-2021-21859
An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The striboxread function is used when processing atoms using the 'stri' FOURCC code. An attacker can convince a user to open a video to trigger...
UBUNTU-CVE-2021-21859
An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The striboxread function is used when processing atoms using the 'stri' FOURCC code. An attacker can convince a user to open a video to trigger...
DEBIAN-CVE-2021-32437
The gfhinterfinalize function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...
CVE-2021-32440
The MediaRewriteODFrame function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...
UBUNTU-CVE-2021-32438
The gfmediaexportfilters function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...
pdfbox: OutOfMemory-Exception while loading a crafted PDF file
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions...
GPAC code-related vulnerabilities
GPAC is a multimedia framework for rich media and is distributed under the LGPL license. gfhinterfinalize function in GPAC version 1.0.1 is vulnerable to null pointer dereference. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the MP4Box...
GPAC code-related vulnerabilities
GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a null pointer dereference vulnerability exists in the MediaRewriteODFrame function in GPAC version 1.0.1. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted fil...
Fuzz Off: How to Shake Up Code to Get It Right – Podcast
LAS VEGAS – In 2014, two teams of security researchers independently started fuzz testing OpenSSL. Within days, the advanced black-box software technique led to an exploitable vulnerability in OpenSSL: namely, the Heartbleed vulnerability. What is fuzzing? That’s what the FuzzCon event is all...
CVE-2020-36457
An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox implements the Send and Sync traits for all types T...
ZTE ZXIPTV Cross-site Scripting Vulnerability
ZTE ZXIPTV is a set-top box from ZTE ZTE. A cross-site scripting vulnerability exists in ZTE ZXIPTV EASP version 5.06.04.09, which stems from the application's lack of validation of user input data and filtering of input data. The vulnerability can be exploited by an attacker to trick a user into...
CVE-2021-30586
Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page...
CVE-2021-30586
Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page...
CVE-2021-30586
Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page...