stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-33696 (severity: MEDIUM, weakness: CWE-79)
SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site.
CVE-2021-33697 (severity: MEDIUM, weakness: CWE-1022)
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
CVE-2021-33698 (severity: CRITICAL, weakness: CWE-434)
SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation.
CVE-2021-33699 (severity: HIGH, weakness: NVD-CWE-Other)
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover legitimate apps and to steal user's sensitive information.
CVE-2021-3370 (severity: MEDIUM, weakness: CWE-79)
DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.
CVE-2021-33700 (severity: HIGH, weakness: CWE-288)
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application.
CVE-2021-33701 (severity: CRITICAL, weakness: CWE-89)
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
CVE-2021-33702 (severity: HIGH, weakness: CWE-79)
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets executed in the victim's browser, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.
CVE-2021-33703 (severity: HIGH, weakness: CWE-79)
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.
CVE-2021-33704 (severity: MEDIUM, weakness: CWE-862)
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.
CVE-2021-33705 (severity: HIGH, weakness: CWE-918)
The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.
CVE-2021-33706 (severity: MEDIUM, weakness: CWE-20)
Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
CVE-2021-33707 (severity: MEDIUM, weakness: CWE-601)
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
CVE-2021-33708 (severity: HIGH, weakness: CWE-20)
Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.
CVE-2021-33709 (severity: MEDIUM, weakness: CWE-200)
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system.
CVE-2021-33710 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link.
CVE-2021-33711 (severity: MEDIUM, weakness: CWE-209)
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths.
CVE-2021-33712 (severity: HIGH, weakness: CWE-345)
A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.
CVE-2021-33713 (severity: MEDIUM, weakness: CWE-688)
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a hash function is called with an incorrect argument leading the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
CVE-2021-33714 (severity: MEDIUM, weakness: CWE-476)
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a missing check for the validity of an iterator leads to NULL pointer deference condition, causing the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
CVE-2021-33715 (severity: MEDIUM, weakness: CWE-476)
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a race condition could cause an object to be released before being operated on, leading to NULL pointer deference condition and causing the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
CVE-2021-33716 (severity: MEDIUM, weakness: CWE-312)
A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545-1 (All versions < V1.1). An attacker with access to the subnet of the affected device could retrieve sensitive information stored in cleartext.
CVE-2021-33717 (severity: MEDIUM, weakness: CWE-476)
A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1). When parsing specially crafted CGM Files, a NULL pointer deference condition could cause the application to crash. The application must be restarted to restore the service. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
CVE-2021-33718 (severity: MEDIUM, weakness: CWE-863)
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7), Mendix Applications using Mendix 9 (All versions < V9.3.0). Write access checks of attributes of an object could be bypassed, if user has a write permissions to the first attribute of this object.
CVE-2021-33719 (severity: CRITICAL, weakness: CWE-120)
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition or potential remote code execution.
CVE-2021-33720 (severity: HIGH, weakness: CWE-120)
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition.
CVE-2021-33721 (severity: HIGH, weakness: CWE-78)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to command injection. An authenticated remote attacker with administrative privileges could exploit this vulnerability to execute arbitrary code on the system with system privileges.
CVE-2021-33722 (severity: MEDIUM, weakness: CWE-22)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system.
CVE-2021-33723 (severity: MEDIUM, weakness: CWE-285)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system.
CVE-2021-33724 (severity: CRITICAL, weakness: CWE-22)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path.
CVE-2021-33725 (severity: CRITICAL, weakness: CWE-22)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
CVE-2021-33726 (severity: HIGH, weakness: CWE-22)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
CVE-2021-33727 (severity: MEDIUM, weakness: CWE-200)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system.
CVE-2021-33728 (severity: HIGH, weakness: CWE-502)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.
CVE-2021-33729 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database.
CVE-2021-33730 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33731 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33732 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33733 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33734 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33735 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33736 (severity: HIGH, weakness: CWE-89)
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVE-2021-33737 (severity: HIGH, weakness: CWE-119)
A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 ERPC (All versions), SIMATIC CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 Advanced (All versions < V3.3), SIPLUS NET CP 443-1 (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (All versions < V3.3). Sending a specially crafted packet to port 102/tcp of an affected device could cause a denial of service condition. A restart is needed to restore normal operations.
CVE-2021-33738 (severity: LOW, weakness: CWE-125)
A vulnerability has been identified in JT2Go (All versions < V13.2.0.2), Teamcenter Visualization (All versions < V13.2.0.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13405)
CVE-2021-33739 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE-2021-3374 (severity: MEDIUM, weakness: CWE-22)
Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.
CVE-2021-33740 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Media Remote Code Execution Vulnerability
CVE-2021-33741 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2021-33742 (severity: HIGH, weakness: CWE-787)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2021-33743 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Projected File System Elevation of Privilege Vulnerability
CVE-2021-33744 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Secure Kernel Mode Security Feature Bypass Vulnerability
CVE-2021-33745 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows DNS Server Denial of Service Vulnerability
CVE-2021-33746 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-33749 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Snap-in Remote Code Execution Vulnerability
CVE-2021-3375 (severity: CRITICAL, weakness: CWE-787)
ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution.
CVE-2021-33750 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Snap-in Remote Code Execution Vulnerability
CVE-2021-33751 (severity: HIGH, weakness: CWE-269)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-33752 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Snap-in Remote Code Execution Vulnerability
CVE-2021-33753 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Bing Search Spoofing Vulnerability
CVE-2021-33754 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-33755 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Hyper-V Denial of Service Vulnerability
CVE-2021-33756 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Snap-in Remote Code Execution Vulnerability
CVE-2021-33757 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
CVE-2021-33758 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Hyper-V Denial of Service Vulnerability
CVE-2021-33759 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Desktop Bridge Elevation of Privilege Vulnerability
CVE-2021-3376 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter.
CVE-2021-33760 (severity: MEDIUM, weakness: NVD-CWE-Other)
Media Foundation Information Disclosure Vulnerability
CVE-2021-33761 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2021-33762 (severity: HIGH, weakness: NVD-CWE-Other)
Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2021-33763 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2021-33764 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Key Distribution Center Information Disclosure Vulnerability
CVE-2021-33765 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Installer Spoofing Vulnerability
CVE-2021-33766 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2021-33767 (severity: MEDIUM, weakness: NVD-CWE-Other)
Open Enclave SDK Elevation of Privilege Vulnerability
CVE-2021-33768 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-3377 (severity: MEDIUM, weakness: CWE-79)
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
CVE-2021-33771 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-33772 (severity: HIGH, weakness: NVD-CWE-Other)
Windows TCP/IP Driver Denial of Service Vulnerability
CVE-2021-33773 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2021-33774 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-33775 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-33776 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-33777 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-33778 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-33779 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows AD FS Security Feature Bypass Vulnerability
CVE-2021-3378 (severity: CRITICAL, weakness: CWE-434)
FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.
CVE-2021-33780 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-33781 (severity: HIGH, weakness: NVD-CWE-Other)
Azure AD Security Feature Bypass Vulnerability
CVE-2021-33782 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Authenticode Spoofing Vulnerability
CVE-2021-33783 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows SMB Information Disclosure Vulnerability
CVE-2021-33784 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2021-33785 (severity: HIGH, weakness: NVD-CWE-Other)
Windows AF_UNIX Socket Provider Denial of Service Vulnerability
CVE-2021-33786 (severity: HIGH, weakness: NVD-CWE-Other)
Windows LSA Security Feature Bypass Vulnerability
CVE-2021-33788 (severity: HIGH, weakness: NVD-CWE-Other)
Windows LSA Denial of Service Vulnerability
CVE-2021-33790 (severity: CRITICAL, weakness: CWE-502)
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.
CVE-2021-33792 (severity: HIGH, weakness: CWE-787)
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.
CVE-2021-33793 (severity: CRITICAL, weakness: CWE-787)
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.
CVE-2021-33794 (severity: CRITICAL, weakness: NVD-CWE-Other)
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key during XFA form interaction.
CVE-2021-33795 (severity: MEDIUM, weakness: CWE-755)
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.
CVE-2021-33796 (severity: HIGH, weakness: CWE-416)
In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.
CVE-2021-33797 (severity: CRITICAL, weakness: CWE-119)
Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which leads to a buffer overflow in the pointer *d.
CVE-2021-33798 (severity: MEDIUM, weakness: CWE-476)
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute via a crafted file.