🚨 CVE-2021-46234
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).
🎖@cveNotify
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).
🎖@cveNotify
GitHub
Null Pointer Dereference in gf_node_unregister () at scenegraph/base_scenegraph.c:682 · Issue #2023 · gpac/gpac
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you! I looked for a similar issue and couldn't find any. I tried with the late...
🚨 CVE-2021-41166
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
🎖@cveNotify
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
🎖@cveNotify
GitHub
Merge pull request from GHSA-wff9-w6wc-h67g · nextcloud/android@aa47197
Fix GHSL-2021-1008 by using permission instead of readPermission
🚨 CVE-2022-21723
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
GitHub
Prevent OOB read in multipart parsing
If incoming SIP message contains a malformed multipart, the process of parsing it in `pjsip_multipart_parse()` can potentially cause out-of-bound read access.
### Impact
It affects all PJSIP us...
### Impact
It affects all PJSIP us...
🚨 CVE-2022-21722
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
GitHub
Potential out-of-bound read during RTP/RTCP parsing
There are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access.
### Impact
It affects all users that use PJMEDIA and accepts ...
### Impact
It affects all users that use PJMEDIA and accepts ...
🚨 CVE-2022-21723
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
GitHub
Prevent OOB read in multipart parsing
If incoming SIP message contains a malformed multipart, the process of parsing it in `pjsip_multipart_parse()` can potentially cause out-of-bound read access.
### Impact
It affects all PJSIP us...
### Impact
It affects all PJSIP us...
🚨 CVE-2021-46142
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
🎖@cveNotify
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
🎖@cveNotify
GitHub
[CVE-2021-46142] uriNormalizeSyntax* may free stack memory in out-of-memory situation when handling URIs containing empty segments…
A bug was found within the uriparser. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using uriparser. It would be best if the...
🚨 CVE-2021-46141
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.
🎖@cveNotify
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.
🎖@cveNotify
GitHub
[CVE-2021-46141] .hostText memory is not properly duped/freed in uriNormalizeSyntax*, uriMakeOwner*, uriFreeUriMembers* for some…
A bug was found within the uriparser. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using uriparser. It would be best if the...
🚨 CVE-2021-45942
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
🎖@cveNotify
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
🎖@cveNotify
🚨 CVE-2022-22828
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
🎖@cveNotify
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
🎖@cveNotify
Synametrics
Version History for SynaMan
Trusted by Fortune 500 Companies for cutting edge software products for - Universal Database Querying, Private Cloud Backup, Encrypted File Sharing and Email Security
🚨 CVE-2022-0387
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
🚨 CVE-2022-0370
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
GitHub
CSRF For personal theme · LiveHelperChat/livehelperchat@9f5bc33
Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot. - CSRF For personal theme · LiveHelperChat/livehelperchat@9f5bc33
🚨 CVE-2022-0372
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
🎖@cveNotify
huntr.dev
Cross-site Scripting (XSS) - Stored in crater
4.51K developers have been protected by securing crater. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
🚨 CVE-2021-3641
Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1.2.33 and prior versions.
🎖@cveNotify
Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1.2.33 and prior versions.
🎖@cveNotify
🚨 CVE-2021-23138
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
🎖@cveNotify
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
🎖@cveNotify
www.cisa.gov
WECON LeviStudioU | CISA
1. EXECUTIVE SUMMARY
CVSS v3 7.8
ATTENTION: Low attack complexity
Vendor: WECON
Equipment: LeviStudioU
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow…
CVSS v3 7.8
ATTENTION: Low attack complexity
Vendor: WECON
Equipment: LeviStudioU
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow…
🚨 CVE-2021-23157
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
🎖@cveNotify
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
🎖@cveNotify
www.cisa.gov
WECON LeviStudioU | CISA
1. EXECUTIVE SUMMARY
CVSS v3 7.8
ATTENTION: Low attack complexity
Vendor: WECON
Equipment: LeviStudioU
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow…
CVSS v3 7.8
ATTENTION: Low attack complexity
Vendor: WECON
Equipment: LeviStudioU
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow…
🚨 CVE-2022-21722
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
🎖@cveNotify
GitHub
Potential out-of-bound read during RTP/RTCP parsing
There are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access.
### Impact
It affects all users that use PJMEDIA and accepts ...
### Impact
It affects all users that use PJMEDIA and accepts ...
🚨 CVE-2021-41166
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
🎖@cveNotify
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
🎖@cveNotify
GitHub
Merge pull request from GHSA-wff9-w6wc-h67g · nextcloud/android@aa47197
Fix GHSL-2021-1008 by using permission instead of readPermission
🚨 CVE-2022-0372
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
🎖@cveNotify
huntr.dev
Cross-site Scripting (XSS) - Stored in crater
4.51K developers have been protected by securing crater. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
🚨 CVE-2022-22828
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
🎖@cveNotify
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
🎖@cveNotify
Synametrics
Version History for SynaMan
Trusted by Fortune 500 Companies for cutting edge software products for - Universal Database Querying, Private Cloud Backup, Encrypted File Sharing and Email Security
🚨 CVE-2022-0387
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
🚨 CVE-2022-0370
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
GitHub
CSRF For personal theme · LiveHelperChat/livehelperchat@9f5bc33
Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot. - CSRF For personal theme · LiveHelperChat/livehelperchat@9f5bc33