Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
530 results · page 4 of 11
Jan 15, 2026A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.CVE-2025-70305 · Other software · Gpac · reported by MITREMedium 5.5
A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.CVE-2025-70304 · Other software · Gpac · reported by MITREHigh 7.5
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.CVE-2025-70298 · Other software · Gpac · reported by MITREHigh 8.2
GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026MessagePack for Java is a serializer implementation for Java.CVE-2026-21452 · Other software · msgpack · reported by GitHubHigh 7.5
MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deseri
- Product
- msgpack-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code.CVE-2025-48531 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 18, 2025A vulnerability was found in GPAC up to 2.4.CVE-2025-7797 · Other software · Gpac · reported by VulDBMedium 5.5
A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file src/media_tools/dash_client.c. The manipulation of the argument base_init_url leads to null pointer dereference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 153ea314b6b053db17164f8bc3c7e1e460938eaa. It is recommended to apply a patch to fix this issue.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Feb 28, 2025Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.CVE-2025-25723 · Other software · Gpac · reported by MITREHigh 8.4
Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box.CVE-2024-57184 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163 that can cause a denial of service (DOS) via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tCVE-2022-47090 · Other software · reported by MITREHigh 7.8
GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tile_columns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box.CVE-2024-50665 · Other software · Gpac · reported by MITREMedium 5.5
gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.CVE-2024-50664 · Other software · Gpac · reported by MITREHigh 7.8
gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38.CVE-2023-4679 · Other software · gpac · reported by security@huntr.devMedium 5.5
A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code.CVE-2024-43081 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jun 17, 2024A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master.CVE-2024-6064 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is f4b3e4d2f91bc1749e7a924a8ab171af03a355a8/c1b9c794bad8f262c56f3cf690567980d96662f5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-268792.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master.CVE-2024-6063 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic.CVE-2024-6062 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic.CVE-2024-6061 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374CVE-2024-28319 · Other software · gpac · reported by MITREMedium 6.2
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325CVE-2024-28318 · Other software · gpac · reported by MITREHigh 7.1
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code.CVE-2024-0046 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Mar 9, 2024An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), anCVE-2023-46427 · Other software · gpac · reported by MITRECritical 9.8
An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via null pointer deference in gf_dash_setup_period component in media_tools/dash_client.c.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial CVE-2023-46426 · Other software · gpac · reported by MITREHigh 8.8
Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) via gf_fwrite component in at utils/os_file.c.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.CVE-2024-24267 · Other software · Gpac · reported by MITREHigh 7.5
gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c.CVE-2024-24266 · Other software · Gpac · reported by MITREHigh 7.5
gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.CVE-2024-24265 · Other software · Gpac · reported by MITREHigh 7.5
gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577CVE-2024-22749 · Other software · Gpac · reported by MITREHigh 7.8
GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c.CVE-2023-50120 · Other software · Gpac · reported by MITREMedium 5.5
MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2024-0322 · Other software · gpac · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2024-0321 · Other software · gpac · reported by security@huntr.devCritical 9.8
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers CVE-2023-46929 · Other software · Gpac · reported by MITREHigh 7.5
An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023msgpackr is a fast MessagePack NodeJS/JavaScript implementation.CVE-2023-52079 · Other software · kriszyp · reported by GitHubMedium 6.8
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
- Product
- msgpackr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DCVE-2023-46932 · Other software · Gpac · reported by MITRECritical 9.8
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DoS) via str2ulong class in src/media_tools/avilib.c in gpac/MP4Box.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_baseCVE-2023-47465 · Other software · Gpac · reported by MITREMedium 5.5
An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_base.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.CVE-2023-48958 · Other software · Gpac · reported by MITREMedium 5.5
gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 7, 2023GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300.CVE-2023-46871 · Other software · Gpac · reported by MITREMedium 5.3
GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of service.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 20, 2023GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.CVE-2023-48090 · Other software · Gpac · reported by MITREHigh 7.1
GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.CVE-2023-48039 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.CVE-2023-48014 · Other software · Gpac · reported by MITREHigh 7.8
GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.CVE-2023-48013 · Other software · Gpac · reported by MITREHigh 7.8
GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.CVE-2023-48011 · Other software · gpac · reported by MITREHigh 7.8
GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c.CVE-2023-47384 · Other software · Gpac · reported by MITREMedium 5.5
MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/iCVE-2023-46001 · Other software · gpac · reported by MITREMedium 5.5
Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in gf_isom_get_user_data.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-5998 · Other software · gpac · reported by security@huntr.devHigh 7.5
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.CVE-2023-46928 · Other software · gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.CVE-2023-46927 · Other software · gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box.CVE-2023-46931 · Other software · gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.CVE-2023-46930 · Other software · gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection.CVE-2023-46347 · Other software · ndkdesign · reported by MITRECritical 9.8
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- ndk_steppingpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 16, 2023Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-5595 · Other software · gpac · reported by security@huntr.devMedium 5.5
Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-5586 · Other software · gpac · reported by security@huntr.devHigh 7.8
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.