Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,147 results · page 13 of 23
Nov 10, 2023Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could CVE-2023-46849 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.5
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
- Product
- OpenVPN 2 (Community)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netlists.fedoraproject.org
Nov 6, 2023bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."CVE-2023-38406 · Other software · Frrouting · reported by MITRECritical 9.8
bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023Zero Spam for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32121 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.
- Product
- Zero Spam for
- Affected
- up to 5.4.4
- What to do
- Affects up to 5.4.4. Update Zero Spam for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum.CVE-2023-46232 · Other software · matter-labs · reported by GitHubMedium 5.3
era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.
- Product
- era-compiler-vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.CVE-2022-24400 · Other software · ETSI · reported by cert@ncsc.nlHigh 7.5
A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.
- Product
- TETRA Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtetraburst.comtetraburst.com
Sep 11, 2023An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.CVE-2023-36980 · Other software · Ethereum · reported by MITREMedium 5.3
An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.
- Product
- Blockchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordetherscan.iogithub.com
Sep 11, 2023QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.bloCVE-2023-42467 · Other software · Qemu · reported by MITREMedium 5.5
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices.CVE-2023-3747 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.5
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.
- Product
- WARP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.cloudflare.complay.google.com
Sep 5, 2023ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width.CVE-2023-36307 · Other software · Simonwaldherr · reported by MITREMedium 5.5
ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence
- Product
- Zplgfa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4678 · Other software · gpac · reported by security@huntr.devMedium 5.5
Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.CVE-2021-46312 · Other software · Djvulibre Project · reported by MITREMedium 6.5
An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
- Product
- Djvulibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Aug 22, 2023An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.CVE-2021-46310 · Other software · Djvulibre Project · reported by MITREMedium 6.5
An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
- Product
- Djvulibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Aug 22, 2023An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.CVE-2021-40211 · Other software · Imagemagick · reported by MITREHigh 7.5
An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via CVE-2020-21710 · Other software · Artifex · reported by MITREMedium 5.5
A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comgit.ghostscript.com
Aug 21, 2023Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student CVE-2023-39094 · Other software · Zerowdd · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function.
- Product
- Studentmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.CVE-2023-20588 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
- Product
- EPYC™ 7001 Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Aug 7, 2023Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3CVE-2023-3896 · Other software · OpenCloudOS · reported by security@opencloudos.techHigh 7.8
Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3
- Product
- OpenCloudOS Stream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length CVE-2023-38379 · Other software · rigol · reported by MITREHigh 7.5
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password.
- Product
- mso5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.ycombinator.comtortel.li
Jul 7, 2023Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function.CVE-2021-32494 · Other software · radare2 · reported by patrick@puiterwijk.orgCritical 10
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.
- Product
- radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.CVE-2023-30207 · Other software · Kodi · reported by MITREMedium 5.5
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
- Product
- Kodi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTMLCVE-2021-30203 · Other software · Dzzoffice · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).CVE-2023-35847 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.CVE-2023-3044 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 3.3
An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comxpdfreader.com
May 30, 2023Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser.CVE-2022-47525 · Other software · Fox-it · reported by MITREHigh 7.5
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.
- Product
- FOX Datadiode Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-2839 · Other software · gpac · reported by security@huntr.devHigh 7.5
Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.CVE-2023-2662 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 2.9
In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.xpdfreader.comforum.xpdfreader.com
Apr 21, 2023NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may leCVE-2023-25511 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may lead to a limited denial of service.
- Product
- NVIDIA CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Mar 6, 2023A vulnerability classified as critical has been found in Zerocoin libzerocoin.CVE-2017-20180 · Other software · Zerocoin · reported by VulDBMedium 4.6
A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the component Proof Handler. The manipulation leads to insufficient verification of data authenticity. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as ce103a09ec079d0a0ed95475992348bed6e860de. It is recommended to apply a patch to fix this issue. VDB-222318 is the identifier assigned to this vulnerability.
- Product
- libzerocoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.CVE-2023-1127 · Other software · vim · reported by security@huntr.devHigh 7.8
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv.CVE-2023-23109 · Other software · Crasm Project · reported by MITREHigh 7.5
In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv.
- Product
- Crasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality.CVE-2023-0615 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jan 30, 2023Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.CVE-2023-0512 · Other software · vim · reported by security@huntr.devHigh 7.8
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 18, 2023An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that caCVE-2022-46505 · Other software · Matrixssl · reported by MITREHigh 7.5
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data.
- Product
- Matrixssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsmalltown123.notion.site
Jan 17, 2023A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent.CVE-2006-20001 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.gentoo.org
Jan 11, 2023A vulnerability classified as problematic has been found in zerochplus.CVE-2013-10010 · Other software · Zerochplus Project · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in zerochplus. This affects the function PrintResList of the file test/mordor/thread.res.pl. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 9ddf9ecca8565341d8d26a3b2f64540bde4fa273. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218007.
- Product
- Zerochplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.CVE-2022-33299 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 26, 2022Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_rCVE-2021-44758 · Other software · Heimdal Project · reported by MITREHigh 7.5
Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.
- Product
- Heimdal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022An attacker could have written a value to the first element in a zero-length JavaScript array.CVE-2022-38475 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 19, 2022The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.CVE-2022-46399 · Other software · Microchip · reported by MITREHigh 7.5
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
- Product
- Bm78 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrochip.comcomputer.org
Oct 28, 2022Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies CVE-2022-3512 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.7
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client.CVE-2022-3322 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.7
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand.CVE-2022-3320 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.7
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of SerCVE-2022-40363 · Other software · Flipperzero · reported by MITREMedium 5.5
A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.
- Product
- Flipper Zero Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c.CVE-2022-38850 · Other software · Mplayerhq · reported by MITREMedium 5.5
The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c.
- Product
- Mencoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.mplayerhq.hu
Sep 15, 2022Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c.CVE-2022-38865 · Other software · Mplayerhq · reported by MITREMedium 5.5
Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
- Product
- Mencoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.mplayerhq.hu
Sep 15, 2022Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder.CVE-2022-38860 · Other software · Mplayerhq · reported by MITREMedium 5.5
Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
- Product
- Mencoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.mplayerhq.hu
Aug 31, 2022In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.CVE-2022-1841 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.2
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c.CVE-2021-4216 · Other software · Artifex · reported by Red HatMedium 5.5
A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
- Product
- Mupdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comgithub.com
Aug 25, 2022A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file.CVE-2021-33844 · Other software · Sound Exchange Project · reported by Red HatMedium 5.5
A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
- Product
- Sound Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 25, 2022A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file.CVE-2021-23210 · Other software · Sound Exchange Project · reported by Red HatMedium 5.5
A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
- Product
- Sound Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.