deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41408
Published: 2022-06-17
Description: VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/divinepwner/e51050e0d7df77ff1f1379583e8cf7db; https://www.voipmonitor.org/changelog-gui?major=5; https://gist.github.com/divinepwner/e51050e0d7df77ff1f1379583e8cf7db
CVE: CVE-2021-41490
Published: 2022-06-17
Description: Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/ompl/ompl/issues/833; https://github.com/ompl/ompl/issues/833
CVE: CVE-2021-45024
Published: 2022-06-17
Description: ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://asg-zena.com; http://asg.com; https://docs.rocketsoftware.com/bundle/ven[PII_REDACTED]49/page/ayk[PII_REDACTED]26.html
CVE: CVE-2021-45025
Published: 2022-06-17
Description: ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://asg-zena.com; http://asg.com; https://docs.rocketsoftware.com/bundle/ven[PII_REDACTED]49/page/ayk[PII_REDACTED]26.html
CVE: CVE-2021-45026
Published: 2022-06-17
Description: ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://asg-zena.com; http://asg.com; https://docs.rocketsoftware.com/bundle/ven[PII_REDACTED]49/page/ayk[PII_REDACTED]26.html
CVE: CVE-2022-2111
Published: 2022-06-17
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f; https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1; https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f
CVE: CVE-2022-2112
Published: 2022-06-17
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f; https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73; https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f
CVE: CVE-2022-2113
Published: 2022-06-17
Description: Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f; https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57; https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f
CVE: CVE-2022-31296
Published: 2022-06-17
Description: Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/bigzooooz/CVE-2022-31296; https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html; https://github.com/bigzooooz/CVE-2022-31296
CVE: CVE-2022-31784
Published: 2022-06-17
Description: A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005; https://www.mitel.com/support/security-advisories
CVE: CVE-2022-32276
Published: 2022-06-17
Description: Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/BrotherOfJhonny/grafana/blob/main/README.md; https://github.com/grafana/grafana/issues/50336; https://github.com/BrotherOfJhonny/grafana/blob/main/README.md
CVE: CVE-2022-33912
Published: 2022-06-17
Description: A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. Version 1.6 through 1.6.9p29, version 2.0 through 2.0.0p26, version 2.1 through 2.1.0p3, and version 2.2.0i1 are affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://checkmk.com/werk/14098; https://checkmk.com/werk/14098
CVE: CVE-2022-33915
Published: 2022-06-17
Description: Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local privilege escalation. This Hotpatch package is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 or CVE-2021-45046; it provides a temporary mitigation to CVE-2021-44228 by hotpatching the local Java virtual machines. To do so, it iterates through all running Java processes, performs several checks, and executes the Java virtual machine with the same permissions and capabilities as the running process to load the hotpatch. A local user could cause the hotpatch script to execute a binary with elevated privileges by running a custom java process that performs exec() of an SUID binary after the hotpatch has observed the process path and before it has observed its effective user ID.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://alas.aws.amazon.com/AL2/ALAS-2022-1806.html; https://alas.aws.amazon.com/ALAS-2022-1601.html; https://alas.aws.amazon.com/AL2/ALAS-2022-1806.html
CVE: CVE-2021-40903
Published: 2022-06-17
Description: A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/anselal/antminer-monitor; https://packetstormsecurity.com/files/164048/Antminer-Monitor-0.5.0-Authentication-Bypass.html; https://www.exploit-db.com/exploits/50267
CVE: CVE-2022-31246
Published: 2022-06-17
Description: paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-88
References: https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355; https://twitter.com/ElectrumWallet/status/[PII_REDACTED]05665028; https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355
CVE: CVE-2022-31355
Published: 2022-06-17
Description: Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-2.md
CVE: CVE-2022-31356
Published: 2022-06-17
Description: Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-4.md
CVE: CVE-2022-31357
Published: 2022-06-17
Description: Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/online-ordering-system/SQLi-3.md
CVE: CVE-2022-22485
Published: 2022-06-17
Description: In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226325; https://www.ibm.com/support/pages/node/6595655; https://exchange.xforce.ibmcloud.com/vulnerabilities/226325
CVE: CVE-2022-30607
Published: 2022-06-17
Description: IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227294; https://www.ibm.com/support/pages/node/6595759; https://exchange.xforce.ibmcloud.com/vulnerabilities/227294
CVE: CVE-2022-32442
Published: 2022-06-17
Description: u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl (96502)%27bad=", it can cause html injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/u5cms/u5cms/issues/49; https://github.com/u5cms/u5cms/issues/49
CVE: CVE-2022-32444
Published: 2022-06-17
Description: An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/u5cms/u5cms/issues/50; https://github.com/u5cms/u5cms/issues/50
CVE: CVE-2022-30422
Published: 2022-06-17
Description: Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.swascan.com/it/; https://www.swascan.com/it/security-advisory-proietti-planet-time-enterprise-cve-2022-30422/; https://www.swascan.com/it/
CVE: CVE-2022-21184
Published: 2022-06-17
Description: An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-522
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1461; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1461
CVE: CVE-2022-21806
Published: 2022-06-17
Description: A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-368, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1440; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1440
CVE: CVE-2022-29496
Published: 2022-06-17
Description: A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1524; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1524
CVE: CVE-2022-31083
Published: 2022-06-17
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 and 5.2.2 prevent this by introducing a new `rootCertificateUrl` property to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the current root certificate as of May 27, 2022. Keep in mind that the root certificate can change at any time and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known workarounds for this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-295
References: https://developer.apple.com/news/?id=stttq465; https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1; https://github.com/parse-community/parse-server/pull/8054
CVE: CVE-2022-31941
Published: 2022-06-17
Description: Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Gsir97/bug_report/blob/main/vendors/oretnom23/rescue-dispatch-management-system/SQL-1.md; https://github.com/Gsir97/bug_report/blob/main/vendors/oretnom23/rescue-dispatch-management-system/SQL-1.md
CVE: CVE-2022-21213
Published: 2022-06-17
Description: This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/mout/mout/blob/master/src/object/deepFillIn.js; https://github.com/mout/mout/blob/master/src/object/deepMixIn.js; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623
CVE: CVE-2022-22138
Published: 2022-06-17
Description: All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392367; https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392367
CVE: CVE-2022-25345
Published: 2022-06-17
Description: All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28; https://snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-2403100; https://github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28
CVE: CVE-2022-25852
Published: 2022-06-17
Description: All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366; https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365; https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366
CVE: CVE-2022-25856
Published: 2022-06-17
Description: The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-59
References: https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961; https://github.com/argoproj/argo-events/issues/1947; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522
CVE: CVE-2022-25871
Published: 2022-06-17
Description: All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488; https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488
CVE: CVE-2022-25872
Published: 2022-06-17
Description: All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192; https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368; https://github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192
CVE: CVE-2022-31873
Published: 2022-06-17
Description: Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jayus0821/uai-poc/blob/main/Trendnet/IP-110wn/xss2.md; https://github.com/jayus0821/uai-poc/blob/main/Trendnet/IP-110wn/xss2.md
CVE: CVE-2022-31874
Published: 2022-06-17
Description: ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/jayus0821/uai-poc/blob/main/ASUS/RT-N53/command%20injection.md; https://github.com/jayus0821/uai-poc/blob/main/ASUS/RT-N53/command%20injection.md
CVE: CVE-2022-31875
Published: 2022-06-17
Description: Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jayus0821/uai-poc/blob/main/Trendnet/IP-110wn/xss1.md; https://github.com/jayus0821/uai-poc/blob/main/Trendnet/IP-110wn/xss1.md
CVE: CVE-2022-31876
Published: 2022-06-17
Description: netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/jayus0821/uai-poc/blob/main/Netgear/WNAP320/unauth.md; https://www.netgear.com/about/security/; https://github.com/jayus0821/uai-poc/blob/main/Netgear/WNAP320/unauth.md
CVE: CVE-2022-21503
Published: 2022-06-17
Description: Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to Oracle Cloud Infrastructure accessible data. All affected customers were notified of CVE-2022-21503 by Oracle. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS Score: 4.9 (MEDIUM)
References: https://support.oracle.com; https://support.oracle.com
CVE: CVE-2014-125002
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f1caaa1c61310beba705957e6366f0392a0b005b; https://vuldb.com/?id.12588; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f1caaa1c61310beba705957e6366f0392a0b005b
CVE: CVE-2014-125003
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8001e9f7d17e90b4b0898ba64e3b8bbd716c513c; https://vuldb.com/?id.12587; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8001e9f7d17e90b4b0898ba64e3b8bbd716c513c
CVE: CVE-2014-125004
Published: 2022-06-18
Description: A vulnerability has been found in FFmpeg 2.0 and classified as problematic. This vulnerability affects the function decode_hextile of the file libavcodec/vmnc.c. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=6ba02602aa7fc7d38db582e75b8b093fb3c1608d; https://vuldb.com/?id.12586; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=6ba02602aa7fc7d38db582e75b8b093fb3c1608d
CVE: CVE-2014-125005
Published: 2022-06-18
Description: A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3edc3b159503d512c919b3d5902f7026e961823a; https://vuldb.com/?id.12585; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3edc3b159503d512c919b3d5902f7026e961823a