SUSE-SU-2025:20045-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-45492: detect integer overflow in function nextScaffoldPart bsc1229932 - CVE-2024-45491: detect integer overflow in dtdCopy bsc1229931 - CVE-2024-45490: reject negative len for XMLParseBuffer bsc1229930 - CVE-2024-28757: XML Entity...

Security update for expat

This update for expat fixes the following issues: CVE-2024-45492: detect integer overflow in function nextScaffoldPart bsc1229932 CVE-2024-45491: detect integer overflow in dtdCopy bsc1229931 CVE-2024-45490: reject negative len for XMLParseBuffer bsc1229930 CVE-2024-28757: XML Entity Expansion...

The vulnerability of the sqlparse.parse() function in the SQL parser module for Python, Sqlparse, allows a hacker to cause a service failure.

The vulnerability of the sqlparse.parse function in the SQL parser module for Python, Sqlparse, is related to an uncontrolled recursion during the processing of deeply nested lists. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the parse_options function in the sbgdec.c component of the libavformat module of the FFmpeg multimedia library allows a attacker to cause a service failure.

The vulnerability of the parseoptions function in the sbgdec.c component of the libavformat module of the FFmpeg multimedia library is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2025-4114 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A problematic issue has been found in the file / parse/load job-details.php, where the manipulation of the business stream name and company website url arguments leads to cross site...

PT-2025-4102 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A vulnerability has been found in the code, classified as problematic. It affects an unknown part of the file /parse/ call job search ajax.php. The manipulation of the n argument leads to...

CVE-2025-0934: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an unknown part of the file /parse/calljobsearchajax.php. The manipulation of the argument n leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

The vulnerability of the parse_endpoints() function in the tcprewrite editing tool and the Tcpreplay tool for editing and replaying PCAP files allows a hacker to cause a service failure.

The vulnerability of the parseendpoints function in the tcprewrite editing tool for PCAP files, as well as in the Tcpreplay tool for editing and replaying PCAP files, is related to pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the qtdemux_parse_trak function in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.

The vulnerability of the qtdemuxparsetrak function in the Gstreamer multimedia framework is related to integer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Security Bulletin: IBM DataPower Operator vulnerable to DoS due to use of Go (CVE-2024-34155, CVE-2024-34156)

Summary The affected calls are used by DataPower Operator for processing messages exchanged with Kubernetes and IBM DataPower Gateway. Vulnerability Details CVEID:CVE-2024-34156 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a stack exhaustion in Decoder.Decode. By sending...

PT-2025-2591 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible infinite loop in the parseUriInternal function of Intent.java due to improper input validation. This could lead to a local denial of service with no...

PT-2025-5652 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions extract mediaip, parse sdp session, and parse mixed content. No...

llvm:llvm-parse-assembly-fuzzer: Heap-buffer-overflow in llvm::LLParser::PerFunctionState::PerFunctionState

Detailed Report: https://oss-fuzz.com/testcase?key=5309886774181888 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-parse-assembly-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x515000025f64 Crash State:...

SUSE CVE-2025-22865

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

PT-2025-5651 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 8 crash has been reported. The crash occurs in the following functions: extract candidate, parse sdp session, and parse mixed...

Medium: runfinch-finch

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...

Regular Expression Denial Of Service (ReDoS)

Parse-uri is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing, which allows attackers to exploit crafted URLs and cause a denial of service...

PT-2025-2193 · Newtec · Newtec Ntc2299 +2

Name of the Vulnerable Software and Affected Versions: Newtec NTC2218, NTC2250, NTC2299 versions 1.0.1.1 through 2.2.6.19 Description: A buffer overflow issue in the swdownload binary allows attackers to execute arbitrary code. The parse INFO function uses an unrestricted sscanf to read a string ...

@tinyjs/tiny (1.6.6), @trezor/connect (>=9.0.0-beta.1, <=9.0.7) +2 more potentially affected by CVE-2024-36751 via parse-uri (>=1.0.3, <=1.0.7)

parse-uri NPM version =1.0.3, =9.0.0-beta.1, =9.0.0-beta.1, =0.2.0, =0.6.0 Source cves: CVE-2024-36751 Source advisory: OSV:GHSA-6FX8-H7JM-663J...

parse-uri Regular expression Denial of Service (ReDoS)

An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service ReDoS via a crafted URL. PoC js async function exploit const parseuri = require"parse-uri"; // This input is designed to cause excessive backtracking in the regex const craftedInput = 'http://example.com...