Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
194 results · page 2 of 4
Apr 24, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-42033 · Other software · axios · reported by GitHubHigh 7.4
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 10, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-40175 · Other software · axios · reported by GitHubMedium 4.8
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2025-62718 · Other software · axios · reported by GitHubMedium 6.3
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgdatatracker.ietf.org
Apr 8, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-39865 · Other software · axios · reported by GitHubMedium 5.9
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-25639 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026axios4go is a Go HTTP client library.CVE-2026-21697 · Other software · rezmoss · reported by GitHubHigh 8.2
axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.
- Product
- axios4go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Axios Cache Interceptor is a cache interceptor for axios.CVE-2025-69202 · Other software · arthurfiorette · reported by GitHubMedium 6
Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignoring request headers like `Authorization`. When the server responds with `Vary: Authorization` (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization. Server-side applications (APIs, proxies, backend services) that use axios-cache-interceptor to cache requests to upstream services, handle requests from multiple users with different auth tokens, and upstream services replies on `Vary` to differentiate caches are affected. Browser/client-side applications (single user per browser session) are not affected. Services using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different authenticated sessions. After `v1.11.1`, automatic `Vary` header support is now enabled by default. When server responds with `Vary: Au
- Product
- axios-cache-interceptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Axios is a promise based HTTP client for the browser and Node.js.CVE-2025-58754 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025axios is a promise based HTTP client for the browser and node.js.CVE-2025-27152 · Other software · axios · reported by GitHubHigh 7.7
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the executCVE-2025-25947 · Other software · Axiosys · reported by MITREMedium 5.5
An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execution of mp4encrypt with a specially crafted MP4 input file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcessoCVE-2025-25946 · Other software · Axiosys · reported by MITREMedium 5.5
An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcessor::Initialize and AP4_Processor::Process, during the execution of mp4encrypt with a specially crafted MP4 input file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFromSCVE-2025-25945 · Other software · Axiosys · reported by MITREMedium 6.5
An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFromStream at Ap4DescriptorFactory.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RCVE-2025-25944 · Other software · Axiosys · reported by MITREHigh 7.3
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in ApCVE-2025-25943 · Other software · Axiosys · reported by MITREHigh 7.8
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in Ap4Stz2Atom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files.CVE-2025-25942 · Other software · Axiosys · reported by MITREMedium 6.5
An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memory allocated in SampleArray::SampleArray in Mp4Fragment.cpp is not properly released.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remoteCVE-2024-57598 · Other software · Axiosys · reported by MITREMedium 6.5
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remote attacker to cause a denial of service vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',hCVE-2024-57965 · Other software · axios · reported by MITRENone
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.CVE-2024-39338 · Other software · axios · reported by MITREHigh 7.5
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjeffhacks.com
Apr 2, 2024An issue was discovered in Bento4 v1.6.0-641-2-g1529b83.CVE-2024-30808 · Other software · Axiosys · reported by MITRELow 2.7
An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragmentCVE-2024-31005 · Other software · axiosys · reported by MITREHigh 8.1
An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment
- Product
- bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment.CVE-2024-31004 · Other software · Axiosys · reported by MITRECritical 9.8
An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.CVE-2024-25454 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.CVE-2024-25453 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.CVE-2024-25452 · Other software · axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.
- Product
- bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.CVE-2024-25451 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for everyCVE-2023-45857 · Other software · Axios · reported by MITREMedium 6.5
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
- Product
- Axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Aug 22, 2023Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.CVE-2023-38666 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.CVE-2023-29575 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.CVE-2023-29573 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.CVE-2023-29574 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.CVE-2023-29576 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.CVE-2022-40885 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Bento4 1.6.0 has memory leaks via the mp4fragment.CVE-2022-40884 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 1.6.0 has memory leaks via the mp4fragment.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.CVE-2022-43038 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022An issue was discovered in Bento4 1.6.0-639.CVE-2022-43037 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022An issue was discovered in Bento4 v1.6.0-639.CVE-2022-43035 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022An issue was discovered in Bento4 v1.6.0-639.CVE-2022-43034 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022An issue was discovered in Bento4 1.6.0-639.CVE-2022-43033 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022An issue was discovered in Bento4 v1.6.0-639.CVE-2022-43032 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux.CVE-2022-41430 · Other software · Axiosys · reported by MITREHigh 8.8
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag.CVE-2022-41429 · Other software · Axiosys · reported by MITREHigh 8.8
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux.CVE-2022-41428 · Other software · Axiosys · reported by MITREHigh 8.8
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.CVE-2022-41427 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split.CVE-2022-41426 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.CVE-2022-41425 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls.CVE-2022-41424 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.CVE-2022-41423 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary.CVE-2022-41419 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022An issue was discovered in Bento4 1.6.0-639.CVE-2022-41847 · Other software · Axiosys · reported by MITREMedium 5.5
An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4StdCFileByteStream.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022An issue was discovered in Bento4 1.6.0-639.CVE-2022-41846 · Other software · Axiosys · reported by MITREMedium 5.5
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.