Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
194 results · page 4 of 4
Aug 14, 2019An issue was discovered in Bento4 1.5.1.0.CVE-2019-15049 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019An issue was discovered in Bento4 1.5.1.0.CVE-2019-15048 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019An issue was discovered in Bento4 1.5.1.0.CVE-2019-15047 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2019In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer.CVE-2019-13959 · Other software · Axiosys · reported by MITREMedium 6.5
In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. This is different from CVE-2018-20186.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2019An issue was discovered in Bento4 1.5.1.0.CVE-2019-13238 · Other software · Axiosys · reported by MITREHigh 7.5
An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL pointer.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2019Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is CVE-2019-10742 · Other software · axios · reported by report@snyk.ioHigh 7.5
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2019An issue was discovered in Bento4 1.5.1-628.CVE-2019-9544 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1-628. An out of bounds write occurs in AP4_CttsTableEntry::AP4_CttsTableEntry() located in Core/Ap4Array.h. It can be triggered by sending a crafted file to (for example) the mp42hls binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.loginsoft.com
Feb 16, 2019An issue was discovered in Bento4 1.5.1-628.CVE-2019-8382 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in the function AP4_List:Find located in Core/Ap4List.h when called from Core/Ap4Movie.cpp. It can be triggered by sending a crafted file to the mp4dump binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.loginsoft.com
Feb 16, 2019An issue was discovered in Bento4 1.5.1-628.CVE-2019-8380 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in AP4_Track::GetSampleIndexForTimeStampMs() located in Core/Ap4Track.cpp. It can triggered by sending a crafted file to the mp4audioclip binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.loginsoft.com
Feb 16, 2019An issue was discovered in Bento4 1.5.1-628.CVE-2019-8378 · Other software · Axiosys · reported by MITREHigh 8.8
An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4_BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.loginsoft.com
Feb 10, 2019A heap-based buffer over-read occurs in AP4_BitStream::WriteBytes in Codecs/Ap4BitStream.cpp in Bento4 v1.5.1-627.CVE-2019-7699 · Other software · Axiosys · reported by MITREMedium 6.5
A heap-based buffer over-read occurs in AP4_BitStream::WriteBytes in Codecs/Ap4BitStream.cpp in Bento4 v1.5.1-627. Remote attackers could leverage this vulnerability to cause an exception via crafted mp4 input, which leads to a denial of service.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019An issue was discovered in AP4_Array<AP4_CttsTableEntry>::EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627.CVE-2019-7698 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in AP4_Array<AP4_CttsTableEntry>::EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls, a related issue to CVE-2018-20095.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019An issue was discovered in Bento4 v1.5.1-627.CVE-2019-7697 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 v1.5.1-627. There is an assertion failure in AP4_AtomListWriter::Action in Core/Ap4Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter.CVE-2019-7693 · Other software · Axiositalia · reported by MITREMedium 6.1
Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports "Sissi in Rete (con server)" for offline operation.
- Product
- Registro Elettronico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstorage.axiositalia.compastebin.com
Jan 25, 2019An issue was discovered in Bento4 1.5.1-628.CVE-2019-6966 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation related to AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2019An issue was discovered in Bento4 v1.5.1-627.CVE-2019-6132 · Other software · Axiosys · reported by MITREHigh 7.5
An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp when called from the AP4_EsdsAtom class in Core/Ap4EsdsAtom.cpp, as demonstrated by mp42aac.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2019An issue was discovered in Bento4 1.5.1-627.CVE-2018-20659 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. The AP4_StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2018An issue was discovered in Bento4 1.5.1-627.CVE-2018-20502 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer class when called from AP4_HvccAtom::Create in Core/Ap4HvccAtom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018An issue was discovered in Bento4 1.5.1-627.CVE-2018-20409 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. There is a heap-based buffer over-read in AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018An issue was discovered in Bento4 1.5.1-627.CVE-2018-20408 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_StdcFileByteStream::Create in System/StdC/Ap4StdCFileByteStream.cpp, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018An issue was discovered in Bento4 1.5.1-627.CVE-2018-20407 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2018An issue was discovered in Bento4 1.5.1-627.CVE-2018-20186 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive memory allocation, related to AP4_DataBuffer::SetDataSize and AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2018An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627.CVE-2018-20095 · Other software · Axiosys · reported by MITREMedium 6.5
An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018In AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico 1.7.0, secret/relogoff.aspx has XSS via the Error_Desc parameter.CVE-2018-18437 · Other software · Axiositalia · reported by MITREMedium 6.1
In AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico 1.7.0, secret/relogoff.aspx has XSS via the Error_Desc parameter.
- Product
- Registro Elettronico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinaryworld.itexploit-db.com
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14590 · Other software · Axiosys · reported by MITREHigh 7.5
An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14589 · Other software · Axiosys · reported by MITREHigh 8.8
An issue has been discovered in Bento4 1.5.1-624. AP4_Mp4AudioDsiParser::ReadBits in Codecs/Ap4Mp4AudioInfo.cpp has a heap-based buffer over-read.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14588 · Other software · Axiosys · reported by MITREHigh 7.5
An issue has been discovered in Bento4 1.5.1-624. A NULL pointer dereference can occur in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14587 · Other software · Axiosys · reported by MITREHigh 8.8
An issue has been discovered in Bento4 1.5.1-624. AP4_MemoryByteStream::WritePartial in Core/Ap4ByteStream.cpp has a buffer over-read.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14586 · Other software · Axiosys · reported by MITREHigh 8.8
An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in AP4_Mpeg2TsAudioSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp, a different vulnerability than CVE-2018-14532.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14585 · Other software · Axiosys · reported by MITREHigh 8.8
An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a heap-based buffer over-read after a call from the AP4_Stz2Atom class.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018An issue has been discovered in Bento4 1.5.1-624.CVE-2018-14584 · Other software · Axiosys · reported by MITREHigh 8.8
An issue has been discovered in Bento4 1.5.1-624. AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp has a heap-based buffer over-read.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018There exists one invalid memory read bug in AP4_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause aCVE-2018-14545 · Other software · Axiosys · reported by MITREMedium 5.5
There exists one invalid memory read bug in AP4_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp42ts.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018There exists one invalid memory read bug in AP4_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to causeCVE-2018-14544 · Other software · Axiosys · reported by MITREMedium 5.5
There exists one invalid memory read bug in AP4_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp42ts.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a CVE-2018-14543 · Other software · Axiosys · reported by MITREMedium 5.5
There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp4dump.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018An issue was discovered in Bento4 1.5.1-624.CVE-2018-14532 · Other software · Axiosys · reported by MITRECritical 9.8
An issue was discovered in Bento4 1.5.1-624. There is a heap-based buffer over-read in AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp after a call from Mp42Hls.cpp, a related issue to CVE-2018-13846.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018An issue was discovered in Bento4 1.5.1-624.CVE-2018-14531 · Other software · Axiosys · reported by MITRECritical 9.8
An issue was discovered in Bento4 1.5.1-624. There is an unspecified "heap-buffer-overflow" crash in the AP4_HvccAtom class in Core/Ap4HvccAtom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2018In Bento4 v1.5.1-624, AP4_File::ParseStream in Ap4File.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted MP4 file.CVE-2018-14445 · Other software · Axiosys · reported by MITREMedium 6.5
In Bento4 v1.5.1-624, AP4_File::ParseStream in Ap4File.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted MP4 file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhac425.unaux.comgithub.com
Jul 10, 2018An issue has been found in Bento4 1.5.1-624.CVE-2018-13848 · Other software · Axiosys · reported by MITREHigh 7.5
An issue has been found in Bento4 1.5.1-624. It is a SEGV in AP4_StszAtom::GetSampleSize in Core/Ap4StszAtom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2018An issue has been found in Bento4 1.5.1-624.CVE-2018-13847 · Other software · Axiosys · reported by MITREHigh 7.5
An issue has been found in Bento4 1.5.1-624. It is a SEGV in AP4_StcoAtom::AdjustChunkOffsets in Core/Ap4StcoAtom.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2018An issue has been found in Bento4 1.5.1-624.CVE-2018-13846 · Other software · Axiosys · reported by MITRECritical 9.8
An issue has been found in Bento4 1.5.1-624. AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp has a heap-based buffer over-read after a call from Mp42Ts.cpp, a related issue to CVE-2018-14532.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2018The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.CVE-2018-5253 · Other software · Axiosys · reported by MITREHigh 7.8
The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2017The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and applicatCVE-2017-14646 · Other software · Axiosys · reported by MITREHigh 7.5
The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and application crash in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
Sep 11, 2017In the SDK in Bento4 1.5.0-616, the AP4_StssAtom class in Ap4StssAtom.cpp contains a Write Memory Access Violation vulnerability.CVE-2017-14260 · Other software · Axiosys · reported by MITREHigh 7.8
In the SDK in Bento4 1.5.0-616, the AP4_StssAtom class in Ap4StssAtom.cpp contains a Write Memory Access Violation vulnerability. It is possible to exploit this vulnerability and possibly execute arbitrary code by opening a crafted .MP4 file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2017The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial of service (NULL poCVE-2017-12475 · Other software · Axiosys · reported by MITREMedium 5.5
The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.