deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24606
Published: 2021-09-20
Description: The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/fe49f48a-f97a-44fe-8d71-be08e7ce4f83; https://wpscan.com/vulnerability/fe49f48a-f97a-44fe-8d71-be08e7ce4f83
CVE: CVE-2021-24609
Published: 2021-09-20
Description: The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8b639743-3eb5-4f74-a156-76cb657bbe05; https://wpscan.com/vulnerability/8b639743-3eb5-4f74-a156-76cb657bbe05
CVE: CVE-2021-24613
Published: 2021-09-20
Description: The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0b8c5947-bc73-448e-8f10-a4f4456e4000; https://wpscan.com/vulnerability/0b8c5947-bc73-448e-8f10-a4f4456e4000
CVE: CVE-2021-24618
Published: 2021-09-20
Description: The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/d50b801a-16b5-45e9-a465-e3bb0445cb49; https://wpscan.com/vulnerability/d50b801a-16b5-45e9-a465-e3bb0445cb49
CVE: CVE-2021-24635
Published: 2021-09-20
Description: The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://wpscan.com/vulnerability/854b23d9-e3f8-4835-8d29-140c580f11c9; https://wpscan.com/vulnerability/854b23d9-e3f8-4835-8d29-140c580f11c9
CVE: CVE-2021-24636
Published: 2021-09-20
Description: The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/db8ace7b-7a44-4620-9fe8-ddf0ad520f5e; https://wpscan.com/vulnerability/db8ace7b-7a44-4620-9fe8-ddf0ad520f5e
CVE: CVE-2021-24637
Published: 2021-09-20
Description: The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dd2b3f22-5e8b-41cf-bcb8-d2e673e1d21e; https://wpscan.com/vulnerability/dd2b3f22-5e8b-41cf-bcb8-d2e673e1d21e
CVE: CVE-2021-24638
Published: 2021-09-20
Description: The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://wpscan.com/vulnerability/c783a746-f1fe-4d68-9d0a-477de5dbb35c; https://wpscan.com/vulnerability/c783a746-f1fe-4d68-9d0a-477de5dbb35c
CVE: CVE-2021-24639
Published: 2021-09-20
Description: The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-352, CWE-862, CWE-22, CWE-352
References: https://wpscan.com/vulnerability/1ada2a96-32aa-4e37-809c-705db6026e0b; https://wpscan.com/vulnerability/1ada2a96-32aa-4e37-809c-705db6026e0b
CVE: CVE-2021-24640
Published: 2021-09-20
Description: The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e61dd498-5d0e-45ce-b660-a36c576f8d78; https://wpscan.com/vulnerability/e61dd498-5d0e-45ce-b660-a36c576f8d78
CVE: CVE-2021-24657
Published: 2021-09-20
Description: The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8; https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8
CVE: CVE-2021-24663
Published: 2021-09-20
Description: The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/8b5b5b57-50c5-4cd8-9171-168c3e9df46a; https://wpscan.com/vulnerability/8b5b5b57-50c5-4cd8-9171-168c3e9df46a
CVE: CVE-2021-24741
Published: 2021-09-20
Description: The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://board.support/changes; https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9; https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca
CVE: CVE-2019-16651
Published: 2021-09-20
Description: An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/; https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-in-virgin-media-routers; https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/
CVE: CVE-2020-21913
Published: 2021-09-20
Description: International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/unicode-org/icu/pull/886; https://lists.debian.org/debian-lts-announce/2021/10/msg00008.html; https://unicode-org.atlassian.net/browse/ICU-20850
CVE: CVE-2021-39402
Published: 2021-09-20
Description: MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS; https://www.maianscriptworld.co.uk/; https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
CVE: CVE-2021-40674
Published: 2021-09-20
Description: An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/198; https://github.com/wuzhicms/wuzhicms/issues/198
CVE: CVE-2020-20891
Published: 2021-09-20
Description: Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/64a805883d7223c868a683f0030837d859edd2ab; https://trac.ffmpeg.org/ticket/8282; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/64a805883d7223c868a683f0030837d859edd2ab
CVE: CVE-2020-20892
Published: 2021-09-20
Description: An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
CVSS Score: 8.8 (HIGH)
CWE: CWE-369
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=19587c9332f5be4f6bc6d7b2b8ef3fd21dfeaa01; https://trac.ffmpeg.org/ticket/8265; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=19587c9332f5be4f6bc6d7b2b8ef3fd21dfeaa01
CVE: CVE-2020-20893
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22030. Reason: This candidate is a duplicate of CVE-2020-22030. Notes: All CVE users should reference CVE-2020-22030 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20894
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22025. Reason: This candidate is a duplicate of CVE-2020-22025. Notes: All CVE users should reference CVE-2020-22025 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20895
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22028. Reason: This candidate is a duplicate of CVE-2020-22028. Notes: All CVE users should reference CVE-2020-22028 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20896
Published: 2021-09-20
Description: An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/dd01947397b98e94c3f2a79d5820aaf4594f4d3b; https://trac.ffmpeg.org/ticket/8273; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/dd01947397b98e94c3f2a79d5820aaf4594f4d3b
CVE: CVE-2020-20897
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22035. Reason: This candidate is a duplicate of CVE-2020-22035. Notes: All CVE users should reference CVE-2020-22035 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20898
Published: 2021-09-20
Description: Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23; https://trac.ffmpeg.org/ticket/8263; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23
CVE: CVE-2020-20899
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20900
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22032. Reason: This candidate is a duplicate of CVE-2020-22032. Notes: All CVE users should reference CVE-2020-22032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20901
Published: 2021-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22022. Reason: This candidate is a duplicate of CVE-2020-22022. Notes: All CVE users should reference CVE-2020-22022 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-20902
Published: 2021-09-20
Description: A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could result in disclosure of information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=0c61661a2cbe1b8b284c80ada1c2fdddf4992cad; https://trac.ffmpeg.org/ticket/8176; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=0c61661a2cbe1b8b284c80ada1c2fdddf4992cad
CVE: CVE-2020-21468
Published: 2021-09-20
Description: A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version, such as 5.0.7
CVSS Score: 7.5 (HIGH)
References: http://redis.com; https://github.com/antirez/redis/issues/6633; http://redis.com
CVE: CVE-2021-32265
Published: 2021-09-20
Description: An issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4_MemoryByteStream::WritePartial() located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/axiomatic-systems/Bento4/issues/545; https://github.com/axiomatic-systems/Bento4/issues/545
CVE: CVE-2021-32268
Published: 2021-09-20
Description: Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/commit/388ecce75d05e11fc8496aa4857b91245007d26e; https://github.com/gpac/gpac/issues/1587; https://github.com/gpac/gpac/commit/388ecce75d05e11fc8496aa4857b91245007d26e
CVE: CVE-2021-32269
Published: 2021-09-20
Description: An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function ilst_item_box_dump located in box_dump.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1574; https://github.com/gpac/gpac/issues/1574
CVE: CVE-2021-32270
Published: 2021-09-20
Description: An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function vwid_box_del located in box_code_base.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1586; https://github.com/gpac/gpac/issues/1586
CVE: CVE-2021-32271
Published: 2021-09-20
Description: An issue was discovered in gpac through 20200801. A stack-buffer-overflow exists in the function DumpRawUIConfig located in odf_dump.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1575; https://github.com/gpac/gpac/issues/1575
CVE: CVE-2021-32272
Published: 2021-09-20
Description: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/knik0/faad2/commit/1b71a6ba963d131375f5e489b3b25e36f19f3f24; https://github.com/knik0/faad2/issues/57; https://www.debian.org/security/2022/dsa-5109
CVE: CVE-2021-32273
Published: 2021-09-20
Description: An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/56; https://www.debian.org/security/2022/dsa-5109; https://github.com/knik0/faad2/issues/56
CVE: CVE-2021-32274
Published: 2021-09-20
Description: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/60; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html; https://www.debian.org/security/2022/dsa-5109
CVE: CVE-2021-32275
Published: 2021-09-20
Description: An issue was discovered in faust through v2.30.5. A NULL pointer dereference exists in the function CosPrim::computeSigOutput() located in cosprim.hh. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/grame-cncm/faust/issues/482; https://github.com/grame-cncm/faust/issues/482
CVE: CVE-2021-32276
Published: 2021-09-20
Description: An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/knik0/faad2/issues/58; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html; https://www.debian.org/security/2022/dsa-5109
CVE: CVE-2021-32277
Published: 2021-09-20
Description: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/59; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html; https://www.debian.org/security/2022/dsa-5109
CVE: CVE-2021-32278
Published: 2021-09-20
Description: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/62; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html; https://www.debian.org/security/2022/dsa-5109
CVE: CVE-2021-32280
Published: 2021-09-20
Description: An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allows an attacker to cause Denial of Service. The fixed version of fig2dev is 3.2.8.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html; https://lists.debian.org/debian-lts-announce/2023/01/msg00044.html; https://sourceforge.net/p/mcj/fig2dev/ci/f17a3b8a7d54c1bc56ab[PII_REDACTED]2a0b3ec991/
CVE: CVE-2021-32281
Published: 2021-09-20
Description: An issue was discovered in gravity through 0.8.1. A heap-buffer-overflow exists in the function gnode_function_add_upvalue located in gravity_ast.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/marcobambini/gravity/issues/313; https://github.com/marcobambini/gravity/issues/313
CVE: CVE-2021-32282
Published: 2021-09-20
Description: An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_add_check() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/marcobambini/gravity/issues/315; https://github.com/marcobambini/gravity/issues/315
CVE: CVE-2021-32283
Published: 2021-09-20
Description: An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function gravity_string_to_value() located in gravity_value.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/marcobambini/gravity/issues/314; https://github.com/marcobambini/gravity/issues/314
CVE: CVE-2021-32284
Published: 2021-09-20
Description: An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_register_pop_context_protect() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://github.com/marcobambini/gravity/issues/321; https://github.com/marcobambini/gravity/issues/321
CVE: CVE-2021-32285
Published: 2021-09-20
Description: An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function list_iterator_next() located in gravity_core.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/marcobambini/gravity/issues/319; https://github.com/marcobambini/gravity/issues/319
CVE: CVE-2021-32286
Published: 2021-09-20
Description: An issue was discovered in hcxtools through 6.1.6. A global-buffer-overflow exists in the function pcapngoptionwalk located in hcxpcapngtool.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/ZerBea/hcxtools/issues/155; https://github.com/ZerBea/hcxtools/issues/155
CVE: CVE-2021-32287
Published: 2021-09-20
Description: An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nokiatech/heif/issues/86; https://github.com/nokiatech/heif/issues/86
CVE: CVE-2021-32288
Published: 2021-09-20
Description: An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicHeight() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nokiatech/heif/issues/87; https://github.com/nokiatech/heif/issues/87
CVE: CVE-2021-32289
Published: 2021-09-20
Description: An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/nokiatech/heif/issues/85; https://github.com/nokiatech/heif/issues/85
CVE: CVE-2021-32294
Published: 2021-09-20
Description: An issue was discovered in libgig through 20200507. A heap-buffer-overflow exists in the function RIFF::List::GetSubList located in RIFF.cpp. It allows an attacker to cause code Execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/drbye78/libgig/issues/1; https://github.com/drbye78/libgig/issues/1