PT-2025-33658 · Gnu +1 · Gpac +1

Уязвимость функции gf filter pid inst swap delete task утилиты MP4Box мультимедийной платформы GPAC связана с использованием после освобождения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании или выполнить произвольный код...

PT-2025-34089 · Gnu +1 · Gpac +1

Уязвимость функции gf parse lfrac утилиты MP4Box мультимедийной платформы GPAC связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2025-5327

A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit h...

The vulnerability of the gf_odf_vvc_cfg_write_bs function in the odf/descriptors.c file of the MP4Box packaging tool for the GPAC multimedia platform allows a attacker to cause a service failure.

The vulnerability of the gfodfvvccfgwritebs function in the odf/descriptors.c file of the MP4Box packaging tool for the GPAC multimedia platform is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-32670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mark Parnell Spark GF Failed Submissions spark-gf-failed-submissions allows Reflected XSS.This issue affects Spark GF Failed Submissions: from n/a through = 1.3.5...

CVE-2025-32670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mark Parnell Spark GF Failed Submissions spark-gf-failed-submissions allows Reflected XSS.This issue affects Spark GF Failed Submissions: from n/a through = 1.3.5...

CVE-2025-32670 WordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mark Parnell Spark GF Failed Submissions spark-gf-failed-submissions allows Reflected XSS.This issue affects Spark GF Failed Submissions: from n/a through = 1.3.5...

PT-2025-17166 · Unknown · Mark Parnell Spark Gf Failed Submissions

Name of the Vulnerable Software and Affected Versions: Mark Parnell Spark GF Failed Submissions versions 1.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This mea...

The vulnerability of the gf_opus_read_length function, found in the media_tools/av_parsers.c file of the MP4Box encoder for the GPAC multimedia platform, allows a hacker to cause a service failure.

The vulnerability of the gfopusreadlength function, found in the mediatools/avparsers.c file of the MP4Box encoder for the GPAC multimedia platform, is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to cause a service failure...

USN-7264-1 openssl vulnerabilities

It was discovered that OpenSSL clients incorrectly handled authenticating servers using RFC7250 Raw Public Keys. In certain cases, the connection will not abort as expected, possibly causing the communication to be intercepted. CVE-2024-12797 George Pantelakis and Alicja Kario discovered that...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2024-2970)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:4255-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: - Update to version 20241128 git commit ea71da6f0690: i915: Update Xe2LPD DMC to v2.24 cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops iwlwifi: add Bz-gf FW for core89-91 release amdgpu: update smu 13.0.10...

Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications

Impact Timing attacks on Galois Field multiplications in this package. Successful exploitation would effectively allow a downgrade of the security guarantees of the XTS mode to the security guarantees of ECB mode, allowing block swapping, enabling identification of identical blocks, and rendering...

GHSA-J6VM-4R7G-X4GR Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications

Impact Timing attacks on Galois Field multiplications in this package. Successful exploitation would effectively allow a downgrade of the security guarantees of the XTS mode to the security guarantees of ECB mode, allowing block swapping, enabling identification of identical blocks, and rendering...

Vulnerability of the functions EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and BN_GF2m_*() in the Elliptic Curve API of the OpenSSL cryptographic library, which allows a hacker to execute arbitrary code.

The vulnerabilities of the functions ECGROUPnewcurveGF2m, ECGROUPnewfromparams, and BNGF2m in the Elliptic Curve API of the OpenSSL cryptographic library are exploited due to a buffer overflow in the queue. Exploiting these vulnerabilities could allow a remote attacker to execute arbitrary code...

CVE-2024-9143

A flaw was found in OpenSSL. Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of...

CVE-2024-9143

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-9143

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

OpenSSL 3.3.0 < 3.3.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.3.3. It is, therefore, affected by a vulnerability as referenced in the 3.3.3 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...