CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-4637: Divide By Zero

Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file. .This issue affects dlib: before 19.24.7...

CVE-2024-57096

An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file...

CVE-2024-57096

A security vulnerability exists in Kingsoft WPS Office versions prior to v.19302 . A local attacker can exploit this issue by using a crafted file to obtain sensitive information from the system. To remediate this vulnerability, users are recommended to update to version 19302 or later. While a p...

CVE-2025-43549

Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

vim: use-after-free in function ins_compl_get_exp in vim/vim

A flaw was found in Vim, where it is vulnerable to a use-after-free in the inscomplgetexp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim...

nginx: specially crafted MP4 file may cause denial of service

A flaw was found in the ngxhttpmp4module module of Nginx. Processing a specially crafted MP4 file can trigger a buffer over-read and cause the nginx process to terminate, resulting in a denial of service...

Adobe Substance3D 缓冲区错误漏洞

Adobe Substance3D-Stager is a 3D design and rendering software developed by Adobe for creating and presenting 3D scenes. Adobe Substance3D-Stager suffers from an out-of-bounds write vulnerability that stems from the program failing to properly handle specific input. An attacker can exploit the...

Denial of Service (DoS)

Overview org.jeecgframework.boot:jeecg-boot-parent is a low-code development platform. Affected versions of this package are vulnerable to Denial of Service DoS through the unzipFile function. An attacker can cause excessive resource consumption by manipulating the File argument. Details Denial o...

Avaya Equinox Code Execution

The vulnerability of the Avaya Equinox collaboration platform is related to deficiencies in the mechanism for checking uploaded files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by uploading a specially crafted file into the system...

Rockwell Automation Arena Buffer Overflow

The vulnerability of software for discrete event simulation and automation in Rockwell Automation Arena is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to disclose sensitive information and execute arbitrary code, provided that the user opens a...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 138, which stems from a specially crafted file name that may hide file extensions...

Incorrect Calculation of Buffer Size

Overview Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size due to mishandling of image depth after SetQuantumFormat is used. An attacker can manipulate the image processing results by submitting a specially crafted MIFF file. Remediation A fix was pushed int...

Rockwell Automation Arena Buffer Overflow

The vulnerability of software for discrete event simulation and automation in Rockwell Automation Arena lies in the writing beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created DOE file...

Rockwell Automation Arena Code Execution

The vulnerability of the software for discrete event simulation and automation in Rockwell Automation Arena is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created DOE file...

Windows Task Scheduler Command Execution

The vulnerability of Windows operating system task schedulers is related to access control errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with SYSTEM privileges by sending a specially crafted XML file...

SUSE CVE-2016-6713

A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID:...

SUSE CVE-2016-6712

A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the...

MongoDB Shell < 2.3.0 Control Character Injection (MONGOSH-2028)

The version of MongoDB Shell installed on the remote host is prior to 2.3.0. It is, therefore, affected by a vulnerability as referenced in the MONGOSH-2028 advisory. - mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a...

Microsoft Office Full Integer Overflow Code Execution

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise, as well as Microsoft Access, is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially created file...