rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1002205 
DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: DotNetZip
product: DotNetZip.Semvered
Published: 2018-07-25T17:00:00.000Z
CVE-2018-1002206 
SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: SharpCompress
product: SharpCompress
Published: 2018-07-25T17:00:00.000Z
CVE-2018-1002207 
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: golang
product: archiver
Published: 2018-07-25T17:00:00.000Z
CVE-2018-1002208 
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: SharpZipLib
product: SharpZipLib
Published: 2018-07-25T17:00:00.000Z
CVE-2018-1002209 
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: quazip
product: quazip
Published: 2018-07-25T17:00:00.000Z
CVE-2018-10000 
The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T03:00:00.000Z
CVE-2018-10001 
The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T03:00:00.000Z
CVE-2018-10016 
Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T05:00:00.000Z
CVE-2018-10017 
soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T05:00:00.000Z
CVE-2018-10018 
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-13T17:00:00.000Z
CVE-2018-10021 
drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T17:00:00.000Z
CVE-2018-10023 
Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T17:00:00.000Z
CVE-2018-10024 
ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH (or TELNET if it is enabled).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T17:00:00.000Z
CVE-2018-10026 
The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T18:00:00.000Z
CVE-2018-10027 
ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILES(X86)%\ESTsoft\ALZip\Formats, or %PROGRAMFILES(X86)%\ESTsoft\ALZip\Coders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-17T12:00:00.000Z
CVE-2018-10028 
joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T18:00:00.000Z
CVE-2018-10029 
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T19:00:00.000Z
CVE-2018-10030 
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T19:00:00.000Z
CVE-2018-10031 
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T19:00:00.000Z
CVE-2018-10032 
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T19:00:00.000Z
CVE-2018-10033 
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T19:00:00.000Z
CVE-2018-10048 
iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T20:00:00.000Z
CVE-2018-10049 
iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T20:00:00.000Z
CVE-2018-10050 
iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T20:00:00.000Z
CVE-2018-10051 
iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T20:00:00.000Z
CVE-2018-10052 
iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T20:00:00.000Z
CVE-2018-10054 
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T00:00:00.000Z
CVE-2018-10055 
Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-24T16:17:53.000Z
CVE-2018-10057 
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T21:00:00.000Z
CVE-2018-10058 
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the addpool, failover-only, poolquota, and save command handlers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T21:00:00.000Z
CVE-2018-10059 
Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T16:00:00.000Z
CVE-2018-10060 
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T16:00:00.000Z
CVE-2018-10061 
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T16:00:00.000Z
CVE-2018-10063 
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T19:00:00.000Z
CVE-2018-10066 
An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network (for example, at site-to-site tunnels).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T13:00:00.000Z
CVE-2018-10068 
The jDownloads extension before 3.2.59 for Joomla! has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T18:00:00.000Z
CVE-2018-10070 
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters, preventing the affected router from accepting new FTP connections. The router will reboot after 10 minutes, logging a "router was rebooted without proper shutdown" message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-16T21:00:00.000Z
CVE-2018-10071 
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953826DB DeviceIoControl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T18:00:00.000Z
CVE-2018-10072 
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953827bf DeviceIoControl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T18:00:00.000Z
CVE-2018-10073 
joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T18:00:00.000Z
CVE-2018-10074 
The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a denial of service (NULL pointer dereference) by triggering a failure of resource retrieval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T18:00:00.000Z
CVE-2018-10075 
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T16:00:00.000Z
CVE-2018-10076 
An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T16:00:00.000Z
CVE-2018-10077 
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T21:00:00.000Z
CVE-2018-10078 
Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T21:00:00.000Z
CVE-2018-10079 
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configuration data by updating (1) config.xml or (2) servers.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T21:00:00.000Z
CVE-2018-10080 
Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52_es_FRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wan_dns.asp request in conjunction with a crafted admin cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T04:00:00.000Z
CVE-2018-10081 
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10082 
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10083 
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10084 
CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10085 
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10086 
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T05:00:00.000Z
CVE-2018-10087 
The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T13:00:00.000Z
CVE-2018-10088 
Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-08T12:00:00.000Z
CVE-2018-10091 
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T17:00:57.000Z
CVE-2018-10092 
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-22T20:00:00.000Z
CVE-2018-10093 
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T17:05:45.000Z
CVE-2018-10094 
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-22T20:00:00.000Z
CVE-2018-10095 
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-22T20:00:00.000Z
CVE-2018-10096 
joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T16:00:00.000Z
CVE-2018-10097 
XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T21:00:00.000Z
CVE-2018-10098 
In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send a 0x830020E0 IOCTL request to \\.\econceal to cause a denial of service (BSOD).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-13T17:00:00.000Z
CVE-2018-10099 
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T09:00:00.000Z
CVE-2018-10100 
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T13:00:00.000Z
CVE-2018-10101 
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T13:00:00.000Z
CVE-2018-10102 
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T13:00:00.000Z
CVE-2018-10103 
tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:05:26.000Z
CVE-2018-10105 
tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:07:15.000Z
CVE-2018-10106 
D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a /getcfg.php?a=%0a_POST_SERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZED_GROUP%3D1 request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-16T06:00:00.000Z
CVE-2018-10107 
D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-16T06:00:00.000Z
CVE-2018-10108 
D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-16T06:00:00.000Z
CVE-2018-10109 
Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T13:00:00.000Z
CVE-2018-10110 
D-Link DIR-615 T1 devices allow XSS via the Add User feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T21:00:00.000Z
CVE-2018-10111 
An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T14:00:00.000Z
CVE-2018-10112 
An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PNG file that is mishandled during a call to the babl_format_get_bytes_per_pixel function in babl-format.c in babl 0.1.46.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T14:00:00.000Z
CVE-2018-10113 
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-14T14:00:00.000Z