USN-5882-1 dcmtk vulnerabilities

Gjoko Krstic discovered that DCMTK incorrectly handled buffers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2015-8979...

SUSE CVE-2020-15807

GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

SUSE-SU-2022:3020-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2022-24828: Fixed a code injection issue that affected integrators using specific APIs to read untrusted input files bsc1198494...

GHSA-P6C5-737R-2R93 XXE vulnerability in Jenkins Klocwork Analysis Plugin

Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for the Klocwork plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets...

GHSA-XQ2Q-8HXC-7JR2 XXE vulnerability in Jenkins Valgrind Plugin

Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for the Valgrind plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the...

RCE vulnerability in Jenkins OpenShift Pipeline Plugin

OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to provide YAML input files to OpenShift Pipeline Plugin’s build step. OpenShift...

XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the readXml or writeXml build step to have Jenkins parse a crafted file that uses external entities for...

GHSA-8RX6-V5Q4-XW3J enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted...

enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted...

XXE vulnerability in covcomplplot

covcomplplot 1.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted file that uses external entities f...

GHSA-66WW-999Q-MFFQ Arbitrary code execution in post-loader

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there...

CVE-2022-0748

The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed...

MGASA-2021-0513 Updated transfig packages fix security vulnerability

Correct buffer overflows and segfaults, mainly due to maliciously crafted input files...

Updated transfig packages fix security vulnerability

Correct buffer overflows and segfaults, mainly due to maliciously crafted input files...

Siemens JT2Go and Teamcenter Visualization Double Release Vulnerability

Siemens Jt2go is a JT file viewer.Siemens Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A double release vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2. The...

Jason Summers deark 代码问题漏洞

Jason Summers deark is a Jason Summers open source application. A command line utility that can decode certain types of files. A null pointer dereference vulnerability exists in the dbufwrite function in src/deark-dbuf.c in versions of Jason Summers deark prior to 1.5.8, which can be exploited by...

The vulnerability of the FastHufDecoder function in the OpenEXR library, which allows a hacker to cause a service failure

The vulnerability of the FastHufDecoder function in the OpenEXR library is related to integer overflow during the processing of input files. Exploiting this vulnerability can allow a malicious actor to cause service failures by creating specially crafted EXR files...

USN-4835-1 vcftools vulnerabilities

It was discovered that VCFtools improperly handled certain input. If a user were tricked into opening a crafted input file, VCFtools could be made to crash or possibly cause other unspecified impact. CVE-2018-11099, CVE-2018-11129, CVE-2018-11130 It was discovered that VCFtools improperly handled...

FreeBSD : openexr, ilmbase -- security fixes related to reading corrupted input files (98044aba-6d72-11eb-aed7-1b1b8a70cc8b)

Cary Phillips reports : Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files.... C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021...