deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-34722
Published: 2024-07-09
Description: In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303
References: https://source.android.com/security/bulletin/2025-01-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/456f705b9acc78d8184536baff3d21b0bc11c957; https://source.android.com/security/bulletin/2024-07-01
CVE: CVE-2024-34723
Published: 2024-07-09
Description: In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-783
References: https://android.googlesource.com/platform/frameworks/base/+/c702bb[PII_REDACTED]0debe0c18fcf8834cfa2454f; https://source.android.com/security/bulletin/2024-07-01; https://android.googlesource.com/platform/frameworks/base/+/c702bb[PII_REDACTED]0debe0c18fcf8834cfa2454f
CVE: CVE-2024-34724
Published: 2024-07-09
Description: In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://source.android.com/security/bulletin/2024-07-01; https://source.android.com/security/bulletin/2024-07-01
CVE: CVE-2024-34725
Published: 2024-07-09
Description: In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-269, CWE-284
References: https://source.android.com/security/bulletin/2024-07-01; https://source.android.com/security/bulletin/2024-07-01
CVE: CVE-2024-34726
Published: 2024-07-09
Description: In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-783
References: https://source.android.com/security/bulletin/2024-07-01; https://source.android.com/security/bulletin/2024-07-01
CVE: CVE-2024-37829
Published: 2024-07-09
Description: An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-37829; https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-37829
CVE: CVE-2024-37865
Published: 2024-07-09
Description: An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compatible storage component.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://gist.github.com/iTrooz/629bd30cfa09cc527a0859e8cca83a4b; https://gist.github.com/iTrooz/629bd30cfa09cc527a0859e8cca83a4b
CVE: CVE-2024-38959
Published: 2024-07-09
Description: Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40geetmadan22/reflected-cross-site-scripting-on-academy-lms-learning-management-system-product-4ab04ef51022; https://medium.com/%40geetmadan22/reflected-cross-site-scripting-on-academy-lms-learning-management-system-product-4ab04ef51022
CVE: CVE-2024-39031
Published: 2024-07-09
Description: In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/toneemarqus/CVE-2024-39031; https://www.github.com/Silverpeas/Silverpeas-Core/pull/1346; https://github.com/toneemarqus/CVE-2024-39031
CVE: CVE-2024-39071
Published: 2024-07-09
Description: Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/Y5neKO/561a038dab8584c1448aad3013b9c2c7; https://gist.github.com/Y5neKO/561a038dab8584c1448aad3013b9c2c7
CVE: CVE-2024-39072
Published: 2024-07-09
Description: AMTT Hotel Broadband Operation System (HiBOS) v3.0.3.151204 is vulnerable to SQL injection via manager/conference/calendar_remind.php.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/Y5neKO/4c15581606c118aa2172afd3b8b74328; https://gist.github.com/Y5neKO/4c15581606c118aa2172afd3b8b74328
CVE: CVE-2024-39181
Published: 2024-07-09
Description: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerate_conf_router() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/SunsetR/Vulnerability-information/blob/main/LBT-T300-T400_ApCliSsid_Buffer%20overflow.md; https://github.com/SunsetR/Vulnerability-information/blob/main/LBT-T300-T400_ApCliSsid_Buffer%20overflow.md
CVE: CVE-2024-21993
Published: 2024-07-09
Description: SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability
 which could allow an authenticated attacker to discover plaintext 
credentials.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-312
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-35154
Published: 2024-07-09
Description: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292641; https://www.ibm.com/support/pages/node/7159825; https://exchange.xforce.ibmcloud.com/vulnerabilities/292641
CVE: CVE-2024-36676
Published: 2024-07-09
Description: Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/BookStackApp/BookStack/issues/4993; https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1; https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/
CVE: CVE-2024-38963
Published: 2024-07-09
Description: Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Reviews) when creating a new review.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/iamtron01/Vulnerability-Research/tree/main/CVE-2024-38963; https://github.com/nopSolutions/nopCommerce/issues/7224; https://github.com/iamtron01/Vulnerability-Research/tree/main/CVE-2024-38963
CVE: CVE-2024-39069
Published: 2024-07-09
Description: An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-491
References: https://github.com/AungSoePaing/CVE-2024-39069; https://youtu.be/oMIobV2M0T8; https://github.com/AungSoePaing/CVE-2024-39069
CVE: CVE-2024-39880
Published: 2024-07-09
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01
CVE: CVE-2024-39881
Published: 2024-07-09
Description: Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01
CVE: CVE-2024-39882
Published: 2024-07-09
Description: Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01
CVE: CVE-2024-39883
Published: 2024-07-09
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01
CVE: CVE-2024-39900
Published: 2024-07-09
Description: OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/opensearch-project/reporting/commit/2403014c57ee63268e83d919db3334b676a8c992; https://github.com/opensearch-project/reporting/security/advisories/GHSA-xmvg-335g-x44q; https://opensearch.org/versions/opensearch-2-14-0.html
CVE: CVE-2024-39901
Published: 2024-07-09
Description: OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e; https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33; https://opensearch.org/versions/opensearch-2-14-0.html
CVE: CVE-2024-21832
Published: 2024-07-09
Description: A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
CVSS Score: 3.5 (LOW)
CWE: CWE-94
References: https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83; https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83
CVE: CVE-2024-22377
Published: 2024-07-09
Description: The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83; https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83
CVE: CVE-2024-22477
Published: 2024-07-09
Description: A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
CVSS Score: 1.8 (LOW)
CWE: CWE-79, CWE-79
References: https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83; https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu[PII_REDACTED]83
CVE: CVE-2024-21417
Published: 2024-07-10
Description: Windows Text Services Framework Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21417; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21417
CVE: CVE-2024-25023
Published: 2024-07-10
Description: IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  281429.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281429; https://www.ibm.com/support/pages/node/7159768; https://exchange.xforce.ibmcloud.com/vulnerabilities/281429
CVE: CVE-2024-32670
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's location by scanning the BLE adversting.
CWE: CWE-200
References: https://securityreport.samsung.com; https://securityreport.samsung.com
CVE: CVE-2024-6433
Published: 2024-07-10
Description: The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://huntr.com/bounties/7d0463dd-6373-4eb8-86fc-beac0a1391a5; https://huntr.com/bounties/7d0463dd-6373-4eb8-86fc-beac0a1391a5
CVE: CVE-2023-7061
Published: 2024-07-10
Description: The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/; https://www.wordfence.com/threat-intel/vulnerabilities/id/26050f70-7a10-4df5-acd5-1c9e7613bf2c?source=cve; https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/
CVE: CVE-2023-7062
Published: 2024-07-10
Description: The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-538
References: https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve; https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/
CVE: CVE-2024-22018
Published: 2024-07-10
Description: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 2.9 (LOW)
References: http://www.openwall.com/lists/oss-security/2024/07/11/6; http://www.openwall.com/lists/oss-security/2024/07/19/3; https://hackerone.com/reports/2145862
CVE: CVE-2024-4866
Published: 2024-07-10
Description: The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37554 is potentially a duplicate of this.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ultraaddons-elementor-lite/trunk/inc/widget/advance-pricing-table.php#L1340; https://plugins.trac.wordpress.org/browser/ultraaddons-elementor-lite/trunk/inc/widget/hero-slider.php#L919; https://plugins.trac.wordpress.org/browser/ultraaddons-elementor-lite/trunk/inc/widget/hotspot.php#L341
CVE: CVE-2024-5677
Published: 2024-07-10
Description: The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/featured-image-generator/tags/1.3.1/admin/class-featured-image-generator-admin.php#L575; https://www.wordfence.com/threat-intel/vulnerabilities/id/56161d67-7378-4349-8fe5-da73da36afa0?source=cve; https://plugins.trac.wordpress.org/browser/featured-image-generator/tags/1.3.1/admin/class-featured-image-generator-admin.php#L575
CVE: CVE-2024-5792
Published: 2024-07-10
Description: The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://favethemes.zendesk.com/hc/en-us/articles/[PII_REDACTED]32-Changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d4df4b-ec7a-43f6-8617-161b1600d6d2?source=cve; https://favethemes.zendesk.com/hc/en-us/articles/[PII_REDACTED]32-Changelog
CVE: CVE-2023-32467
Published: 2024-07-10
Description: Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-665, CWE-665
References: https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200; https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200
CVE: CVE-2023-32472
Published: 2024-07-10
Description: Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some code in System Management Mode, leading to arbitrary code execution or escalation of privilege.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200; https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200
CVE: CVE-2024-38301
Published: 2024-07-10
Description: Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. A low privileged attacker could potentially exploit this vulnerability, leading to denial of service on the local system and information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1107
References: https://www.dell.com/support/kbdoc/en-us/000225774/dsa-2024-258; https://www.dell.com/support/kbdoc/en-us/000225774/dsa-2024-258
CVE: CVE-2024-6550
Published: 2024-07-10
Description: The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/gravity-forms-multiple-form-instances/trunk/tests/bootstrap.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3114842%40gravity-forms-multiple-form-instances&new=3114842%40gravity-forms-multiple-form-instances&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec761eb-6bd9-4c19-a98d-cb4738922a84?source=cve
CVE: CVE-2024-21521
Published: 2024-07-10
Description: All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/dellalibera/98c48fd74bb240adbd7841a5c02aba9e; https://github.com/discordjs/opus/blob/814e500c2785c5207ace[PII_REDACTED]beba2728b/src/node-opus.cc%23L47; https://security.snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-6370643
CVE: CVE-2024-21522
Published: 2024-07-10
Description: All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e; https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L53; https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L79