CVE-2025-5046 DGN File Parsing Out-of-Bounds Read Vulnerability

A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-5046

CVE-2025-5046 affects Autodesk AutoCAD via a flaw in DGN file parsing that can trigger an Out-of-Bounds Read. The vulnerability may cause a crash, allow reading of sensitive data, or enable arbitrary code execution in the context of the current process. Public sources consistently describe the en...

CVE-2025-40762

A vulnerability has been identified in Simcenter Femap V2406 All versions V2406.0003, Simcenter Femap V2412 All versions V2412.0002. The affected applications contain an out of bounds write vulnerability when parsing a specially crafted STP file. This could allow an attacker to execute code in th...

CVE-2025-55198

A flaw was found in helm.sh/helm/v3. Improper validation of type errors during parsing of Chart.yaml and index.yaml files can trigger a panic. A remote attacker, requiring user interaction, can trigger this panic via a malformed chart file. This can lead to an application level denial of service...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via improper validation when parsing Chart.yaml and index.yaml files. An attacker can cause a panic in the application by providing malformed or unexpected YAML content, such as a null maintainer, non-strin...

CVE-2025-55198

CVE-2025-55198 affects Helm (Charts for Kubernetes). Prior to 3.18.5, parsing Chart.yaml and index.yaml could panic due to improper type validation. Helm 3.18.5 fixes the issue; a workaround is to ensure YAML files are formatted as Helm expects before processing. The IBM/Converged IBM bulletins l...

CVE-2011-10016 Real Networks Netzip Classic 7.5.1.86 File Parsing Buffer Overflow

Real Networks Netzip Classic version 7.5.1.86 is vulnerable to a stack-based buffer overflow when parsing a specially crafted ZIP archive. The vulnerability is triggered when the application attempts to process a file name within the archive that exceeds the expected buffer size. Exploitation...

Malicious File Parsing

@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...

CVE-2025-40762

A vulnerability has been identified in Simcenter Femap V2406 All versions V2406.0003, Simcenter Femap V2412 All versions V2412.0002. The affected applications contain an out of bounds write vulnerability when parsing a specially crafted STP file. This could allow an attacker to execute code in th...

CVE-2025-40762

Summary: CVE-2025-40762 affects Siemens/Siemens Simcenter Femap. Affected: Simcenter Femap V2406 (all versions before 2406.0003) and V2412 (all versions before 2412.0002). Vulnerability: out-of-bounds write when parsing a specially crafted STP file, which could allow code execution in the context...

Siemens Simcenter Femap

SUMMARY Simcenter Femap contains a file parsing vulnerability that could be triggered when the application reads files in STP or BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or potentially lead to arbitrary...

CVE-2025-47219

A flaw was found in gstreamer1-plugins-good. The isomp4 plugin's qtdemuxparsetrak function incorrectly handles MP4 file parsing, resulting in a heap buffer over-read. This flaw allows a local attacker to provide a specially crafted MP4 file. This over-read can lead to information disclosure...

CVE-2025-47183

CVE-2025-47183 affects GStreamer up to 1.26.1; isomp4 qtdemux_parse_tree may read past a heap buffer during MP4 parsing, leading to information disclosure. Public advisories from Debian (DLA-4419) fix in gst-plugins-good1.0 1.18.4-2+deb11u4; Amazon Linux 2 ALAS2-2025-3003 fixes to 1.18.4-6.amzn2....

CVE-2025-47219

CVE-2025-47219 affects GStreamer isomp4 plugin (qtdemux_parse_trak) reading past the end of a heap buffer during MP4 parsing, up to GStreamer 1.26.1. Debian LTS and Astra Linux reports fixed packages: gst-plugins-good1.0 1.18.4-2+deb11u4 (Debian 11) and related updates in Amazon Linux 2 (gst-plug...

CVE-2025-47807

In GStreamer through 1.26.1, the subparse plugin's subripunescapeformatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash...

CVE-2025-6632 PSD File Parsing Out-of-Bounds Read Vulnerability

A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-53417

CVE-2025-53417 concerns Delta Electronics DIAView (v4.2.0 and earlier) with a directory traversal information-disclosure vulnerability. The issue arises from insufficient validation of file paths used to process directory requests, enabling an attacker to access non‑authorized files. Public discl...

CVE-2025-53012 MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsin...

Beetel Connection Manager 安全漏洞

Beetel Connection Manager is a network connection management tool from Beetel. A security vulnerability exists in Beetel Connection Manager that originates from improper boundary checking when parsing the NetConfig.ini file, which could lead to arbitrary code execution...

Amazon Linux 2 : jackson (ALAS-2025-2934)

The version of jackson installed on the remote host is prior to 1.9.4-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2934 advisory. jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In...