CVE Vulnerability Catalog

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.

A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a denial of service via a crafted MP4 file.

A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.

A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() (named gp_add_master_standby() in WHPG 6, kept as an alias in WHPG 7). Unlike other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby configured, preventing administrators from adding a real standby until a superuser removes the fake entry. User data is not exposed or modified.

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force segment backends of any other session, including superuser sessions, to write memory context details to segment server logs, which may include query text from other users' cached plans.

An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling enumeration of valid usernames in the external user store.

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging, potentially exposing confidential information.

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages, which can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks.

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A packet with declared zero payload length passes the frame-length check, after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, causing type = p[4] to dereference it and crash the client process.

A vulnerability in the Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that they are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries triggers an out-of-bounds read and potentially crashes the bRPC client.

A use-after-free exists in the RTMP protocol implementation in Apache bRPC (version < 1.18.0). A malicious RTMP peer can crash the process or potentially corrupt memory via a crafted Abort message. The root cause is that the receive path deletes the target RtmpChunkStream object while the send path concurrently dereferences it without synchronization.