CVSS: 7.5EPSS: 0%CPEs: -EXPL: 2CVE-2024-7272 – FFmpeg swresample.c fill_audiodata heap-based overflow
https://notcve.org/view.php?id=CVE-2024-7272
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. ... Es wurde eine kritische Schwachstelle in FFmpeg bis 5.1.5 gefunden. • https://ffmpeg.org https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc5 https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc6 https://vuldb.com/? • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: -EXPL: 1CVE-2024-7055 – FFmpeg pnmdec.c pnm_decode_frame heap-based overflow
https://notcve.org/view.php?id=CVE-2024-7055
A vulnerability was found in FFmpeg up to 7.0.1. ... Se encontró una vulnerabilidad en FFmpeg hasta 7.0.1. ... Es wurde eine Schwachstelle in FFmpeg bis 7.0.1 ausgemacht. • https://ffmpeg.org https://ffmpeg.org/download.html https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3 https://vuldb.com/? • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 1CVE-2024-2029 – Command Injection in mudler/localai
https://notcve.org/view.php?id=CVE-2024-2029
The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. • https://github.com/Instructor-Team8/CVE-2024-20291-POC https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc5305419181c8b33eb1c https://huntr.com/bounties/e092528a-ce3b-4e66-9b98-3f56d6b276b0 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-48909
https://notcve.org/view.php?id=CVE-2023-48909
An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function. Se descubrió un problema en Jave2 versión 3.3.1 que permite a los atacantes ejecutar código arbitrario a través de la función FFmpeg. • https://gist.github.com/Dollhouse-18/288b4774bc296722c9e3c60bafa392bf https://github.com/Dollhouse-18/jave-core-Command-execution-vulnerability •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2023-48702 – Jellyfin Possible Remote Code Execution via custom FFmpeg binary
https://notcve.org/view.php?id=CVE-2023-48702
Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13. Jellyfin es un sistema para gestionar y transmitir medios. • https://github.com/jellyfin/jellyfin/commit/83d2c69516471e2db72d9273c6a04247d0f37c86 https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rr9h-w522-cvmr https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •