PT-2018-16242 · Nasa +1 · Cfitsio +1

Name of the Vulnerable Software and Affected Versions: NASA CFITSIO version 3.42 Description: The issue is related to a stack-based buffer overflow in the ffghbn function when parsing specially crafted images via the library. This can lead to overwriting arbitrary data, potentially allowing an...

Vulnerability Spotlight: TALOS-2018-0529-531 - Multiple Vulnerabilities in NASA CFITSIO library

Vulnerabilities discovered by Tyler Bohan from Talos Overview Talos is disclosing three remote code execution vulnerabilities in the NASA CFITSIO library. CFITSIO is a library of C and Fortran subroutines for reading and writing data files in the Flexible Image Transport System FITS data format...

oig.nasa.gov XSS vulnerability

Open Bug Bounty ID: OBB-600693 Description| Value ---|--- Affected Website:| oig.nasa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

NASA CFITSIO `ffgkyn` Stack Overflow Code Execution Vulnerability

Summary Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigg...

NASA CFITSIO Multiple Stack Overflow Code Execution Vulnerabilities

Summary Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigg...

worldwind.arc.nasa.gov Improper Access Control vulnerability

Open Bug Bounty ID: OBB-593641 Description| Value ---|--- Affected Website:| worldwind.arc.nasa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

science.gsfc.nasa.gov XSS vulnerability

Open Bug Bounty ID: OBB-556120 Description| Value ---|--- Affected Website:| science.gsfc.nasa.gov Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosu...

CVE-2018-1000048

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...

CVE-2018-1000047

NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library...

CVE-2018-1000045

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library Weather data that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1...

CVE-2018-1000046

NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.4...

Design/Logic Flaw

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...

Remote code execution

NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library...

Design/Logic Flaw

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library Weather data that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1...

Remote code execution

NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.4...

CVE-2018-1000045

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library Weather data that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1...

CVE-2018-1000048

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...

CVE-2018-1000048

Affecte​d software: NASA RtRetrievalFramework v1.0. Vulnerability: CWE-502 in the Data retrieval function of RtRetrievalFramework, leading to remote code execution. Impact: remote code execution with attacker-controlled weather data processing as a trigger. The connected documents confirm this CV...

CVE-2018-1000045

CVE-2018-1000045 : Affects NASA Singledop library (Weather data) in version v1.0 . The issue is a CWE-502 leading to remote code execution, exploitable when a victim opens a specially crafted radar data file. The description states this vulnerability has been fixed in v1.1 . Connected documents c...

CVE-2018-1000046

NASA Pyblock radar data parsing library (Python) versions 1.0–1.3 contain a CWE-502 code execution vulnerability. The issue arises in the Radar data parsing library and can be exploited by a victim opening a specially crafted radar data file, enabling remote code execution. The vulnerability is r...