be.vlaanderen.informatievlaanderen.ldes.ldi.nifi:geojson-to-wkt-processor (2.12.0), be.vlaanderen.informatievlaanderen.ldes.ldi.nifi:ldi-processors-bundle (2.12.0) +112 more potentially affected by CVE-2022-46337 via org.apache.derby:derby (>=10.15.1.3, <=10.15.2.0)

org.apache.derby:derby MAVEN version =10.15.1.3, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =0.5.0, =0.1.0, =0.20.0, =0.20.0, =0.26.2 and more Source cves: CVE-2022-46337 Source advisory:...

Metabase GeoJSON Remote Code Execution

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential RCE including environment variables because URLs were not validated prior to being loaded. No...

PT-2023-35558 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read crash has been reported, involving the dwg geojson object and dwg write geojson functions in the llvmfuzz.c file. The crash...

libredwg:llvmfuzz: Heap-buffer-overflow in dwg_geojson_object

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5563607855005696 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

Malicious Package

Overview mongoose-geojson-schema-2d is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

PT-2023-35858 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow WRITE 1 crash has been reported, involving functions such as bit TV to utf8, json cquote, and dwg geojson feature. Recommendations...

libredwg:llvmfuzz: Heap-buffer-overflow in bit_TV_to_utf8

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4733781932900352 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

Malicious code in mongoose-geojson-schema-2d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f64dbcc8b994e165e387b83aad34a6af319aafa0fe13b67eb52d8c5fb286e34f The OpenSSF Package Analysis project identified 'mongoose-geojson-schema-2d' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1239 Malicious code in mongoose-geojson-schema-2d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f64dbcc8b994e165e387b83aad34a6af319aafa0fe13b67eb52d8c5fb286e34f The OpenSSF Package Analysis project identified 'mongoose-geojson-schema-2d' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

PT-2023-35778 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address. The crash involves the dwg ref get object, dwg geojson feature, and dwg geojs...

libredwg:llvmfuzz: Segv on unknown address in dwg_ref_get_object

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=6512734165663744 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State...

libredwg:llvmfuzz: Crash in dwg_ref_get_object

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5187649501003776 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x30284d5c0025 Crash...

Design/Logic Flaw

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-43776

The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...

CVE-2022-43776

CVE-2022-43776 affects Metabase versions prior to 44.5, where the url parameter of the /api/geojson endpoint can be abused to perform a Server Side Request Forgery (SSRF). The issue can be exploited by bypassing blacklists using 301/302 redirects. Impact described in sources indicates exposure to...

Metabase code issues and vulnerabilities

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase versions prior to 44.5, which stems from the /api/geojson endpoint's url parameter can be used to perform a server-side request forgery attack that utilizes 301 and 302...

CVE-2022-43776

The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...

CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-39359

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

PT-2022-24927 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirec...