rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-25994 
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25997 
Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-26001 
Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26002 
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26003 
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26004 
Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26005 
Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26006 
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26007 
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26008 
In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26009 
Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26010 
Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26011 
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-26013 
An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-26014 
A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-26042 
Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-26047 
Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2025-26054 
Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-26055 
An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter of the Tracert function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-26056 
A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the mtrIp parameter. An attacker can exploit this flaw to execute arbitrary operating system commands on the underlying system with the same privileges as the web application process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-26058 
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-26062 
An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-26063 
An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-26064 
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-26065 
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-04T00:00:00.000Z
CVE-2025-26074 
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-30T00:00:00.000Z
CVE-2025-26086 
An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attackers can remotely inject time-delayed SQL payloads to induce server response delays, enabling time-based inference and iterative extraction of sensitive database contents without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-20T00:00:00.000Z
CVE-2025-26091 
A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My Passwords" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-04T00:00:00.000Z
CVE-2025-26125 
An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-26127 
A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-26136 
A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-04T00:00:00.000Z
CVE-2025-26137 
Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this issue to read arbitrary system files by supplying a crafted file path, potentially exposing sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-18T00:00:00.000Z
CVE-2025-26138 
Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do not have permission to view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-18T00:00:00.000Z
CVE-2025-26153 
A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute when victims, such as administrators, reply to the message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2025-26155 
NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-26T00:00:00.000Z
CVE-2025-26156 
A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-26157 
A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to execute arbitrary code via the name POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-26158 
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the department parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-26159 
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2025-26163 
CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-26167 
Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2025-26168 
IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: IXON
product: VPN Client
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-05-07T00:00:00.000Z
CVE-2025-26169 
IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: IXON
product: VPN Client
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-05-07T00:00:00.000Z
CVE-2025-26182 
An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-04T00:00:00.000Z
CVE-2025-26186 
SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-15T00:00:00.000Z
CVE-2025-26198 
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-18T00:00:00.000Z
CVE-2025-26199 
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-18T00:00:00.000Z
CVE-2025-26200 
SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2025-26201 
Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2025-26202 
Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an administrator views the passphrase via the "Click here to display" option on the Status page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-04T00:00:00.000Z
CVE-2025-26206 
Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-26210 
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-03T00:00:00.000Z
CVE-2025-26211 
Gibbon before 29.0.00 allows CSRF.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: GibbonEdu
product: Gibbon
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2025-05-27T00:00:00.000Z
CVE-2025-26241 
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-26258 
Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-26T00:00:00.000Z
CVE-2025-26260 
Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-12T00:00:00.000Z
CVE-2025-26262 
An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and execute arbitrary code via supplying a file that contains a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-06T00:00:00.000Z
CVE-2025-26263 
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2025-26264 
GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-26265 
A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-26268 
DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the scan cursor was not checked.
Problem types: cwe_id: CWE-392
description: CWE-392 Missing Report of Error Condition
Affected products: vendor: DragonflyDB
product: Dragonfly
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: 2025-04-17T00:00:00.000Z
CVE-2025-26269 
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: DragonflyDB
product: Dragonfly
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: 2025-04-17T00:00:00.000Z
CVE-2025-26278 
A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-26304 
A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26305 
A memory leak has been identified in the parseSWF_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26306 
A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26307 
A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26308 
A memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26309 
A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26310 
Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted ABC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-26311 
Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z