📄 textract 2.5.0 Command Injection

textract through version 2.5.0 allows OS command injection through the file path supplied to multiple extractors. Several code paths pass that file path into childprocess.exec with inadequate sanitization. An attacker who can influence the file name or path can break out of the command line and r...

Zed 安全漏洞

Zed is a code editor developed by Zed Industries. Versions of Zed prior to 0.224.4 contained security vulnerabilities. These vulnerabilities stemmed from the fact that the tar extractor created symbolic links without proper verification, which could lead to code execution...

CVE-2026-2245

A vulnerability was identified in CCExtractor up to 183. This affects the function parsePAT/parsePMT in the library src/libccx/tstables.c of the component MPEG-TS File Parser. Such manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is...

Linux Distros Unpatched Vulnerability : CVE-2019-2109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code...

CVE-2024-55504

CVE-2024-55504 affects RAR Extractor - Unarchiver Free and Pro (v.6.4.0) on macOS, where the exploit_combined.dylib component enables local code injection that could lead to remote control and access to sensitive data. The issue is rooted in the dylib component and is reflected with a CVSSv3.1 ba...

UnRAR Backlink Vulnerability

UnRAR is a command that decompresses files with rar extension. A security vulnerability exists in UnRAR versions prior to 6.2.3. An attacker exploited the vulnerability to extract files outside the target folder via symbolic links...

sbfa.org.br Cross Site Scripting vulnerability OBB-2883424

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Design/Logic Flaw

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library...

MediaTek 芯片安全漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek Mediatek. A security vulnerability exists in MediaTek chips that stems from a possible read out-of-bounds due to a heap buffer overflow in the asf extractor. This could result in the disclosure of local...

CVE-2018-16430

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTORzipextractmethod in zipextractor.c...