CVE-2026-61462 mcp-gitlab Path Traversal via job_id Parameter

mcp-gitlab contains a path traversal vulnerability in the jobid parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted jobid values like ../../../user to escape the intended path prefix and access arbitrary GitLab API...

EUVD-2026-43504

mcp-gitlab contains a path traversal vulnerability in the jobid parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted jobid values like ../../../user to escape the intended path prefix and access arbitrary GitLab API...

CVE-2026-15522

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

EUVD-2026-43264

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

PT-2026-57839

Name of the Vulnerable Software and Affected Versions mcp-gitlab versions prior to 2.1.18 Description A path traversal issue exists in the job id parameter within the build/index.js file. This allows attackers to escape the intended path prefix by providing crafted values, such as ../../../user, ...

CVE-2022-38858

Certain The MPlayer Project products are vulnerable to Buffer Overflow via function movbuildindex of libmpdemux/demuxmov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1...

CVE-2022-38856

Certain The MPlayer Project products are vulnerable to Buffer Overflow via function movbuildindex of libmpdemux/demuxmov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1...

obx Security Vulnerabilities

obx is a fast and lightweight object manipulation library for Javascript by the individual developer Gaetan Almela. A security vulnerability exists in obx prior to version v.0.0.4, which originates from a vulnerability that allows arbitrary code execution via the obx/build/index.js, reduce, and...

CVE-2022-38856

Certain The MPlayer Project products are vulnerable to Buffer Overflow via function movbuildindex of libmpdemux/demuxmov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1...

DEBIAN-CVE-2022-38858

Certain The MPlayer Project products are vulnerable to Buffer Overflow via function movbuildindex of libmpdemux/demuxmov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1...

PT-2022-24597 · Mplayer +1 · Mplayer +3

Name of the Vulnerable Software and Affected Versions: mplayer versions SVN-r38374-13.0.1 mencoder versions SVN-r38374-13.0.1 Description: The issue is related to a Buffer Overflow vulnerability via the mov build index function of libmpdemux/demux mov.c. This vulnerability affects certain product...

PT-2022-7419

Name of the Vulnerable Software and Affected Versions MPlayer versions SVN-r38374-13.0.1 Description The issue is related to memory corruption via the function free mp image of libmpcodecs/mp image.c and also involves the mov build index function, which is associated with a buffer overflow. This...

PT-2022-24598 · Unknown +4 · Libmpdemux +4

Name of the Vulnerable Software and Affected Versions: mplayer versions SVN-r38374-13.0.1 mencoder versions SVN-r38374-13.0.1 Description: The issue is related to a Buffer Overflow via the mov build index function of libmpdemux/demux mov.c. This is a general information about the problem, and no...

The vulnerability of the asf_build_simple_index() function in the FFmpeg multimedia library (libavformat/asfdec_f.c) allows a attacker to cause a service failure.

The vulnerability of the asfbuildsimpleindex function in the FFmpeg multimedia library libavformat/asfdecf.c arises from the lack of checking for the end-of-file flag during the processing of ASF files. This leads to repeated execution of the for loop, which is related to the large size of the...

DEBIAN-CVE-2017-14223

In libavformat/asfdecf.c in FFmpeg 3.3.3, a DoS in asfbuildsimpleindex due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would...

UBUNTU-CVE-2017-14223

In libavformat/asfdecf.c in FFmpeg 3.3.3, a DoS in asfbuildsimpleindex due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would...

The vulnerability of the mov_build_index function in the FFmpeg multimedia library allows a hacker to cause unpredictable effects.

The vulnerability of the movbuildindex function in the FFmpeg multimedia library is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker, operating remotely, to exert unpredictable effects using vectors related to the sample size...

PT-2017-2399

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.8 FFmpeg versions 3.0.x prior to 3.0.3 FFmpeg versions 3.1.x prior to 3.1.1 Description The issue is caused by an integer overflow in the mov build index function, which can be exploited by remote attackers via...

Dulwich 'build_index_from_tree' function arbitrary command execution vulnerability

Dulwich is a Python implementation of the file format and protocols of the Git version control system developed by software developer Jelmer Vernooij. A security vulnerability exists in the 'buildindexfromtree' function in the index.py file in versions of Dulwich prior to 0.9.9. A remote attacker...

PT-2015-4356

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 0.9.9 Description The issue allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree. This is due to a...