Overview 98 matches · 13 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
98matches
13in Waratek scope13.3%
2protected2.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
2.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
11
11.2%
Outside Waratek scope
0
0.0%
Not applicable
85
86.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
2.0%
partly blocked
0
0.0%
not blocked
96
98.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
98
100.0%
split by
peak 22 / year
19991
Not applicable1
Medium1
not blocked1
No public exploit1
20000
20010
20020
20030
20040
20050
20063
Not applicable3
High1
Medium1
Low1
not blocked3
No public exploit3
20070
20080
20092
Not applicable2
Medium2
not blocked2
No public exploit2
20100
20113
Not applicable3
Medium3
not blocked3
No public exploit3
20121
Not applicable1
Medium1
not blocked1
No public exploit1
20131
Not applicable1
Low1
not blocked1
No public exploit1
20140
20150
20160
20172
Protected by Waratek2
High2
blocked by ARMR today2
No public exploit2
201822
No exploit published2
Not applicable20
Critical8
High11
Medium3
not blocked22
No public exploit22
201913
No exploit published2
Not applicable11
Critical2
High5
Medium6
not blocked13
No public exploit13
202011
Not applicable11
Critical3
High7
Medium1
not blocked11
No public exploit11
20216
Not applicable6
Critical1
High3
Medium2
not blocked6
No public exploit6
20228
No exploit published1
Not applicable7
Critical2
High4
Medium2
not blocked8
No public exploit8
20236
No exploit published2
Not applicable4
Critical1
High2
Medium3
not blocked6
No public exploit6
20244
Not applicable4
High3
Medium1
not blocked4
No public exploit4
20251
Not applicable1
High1
not blocked1
No public exploit1
202614
No exploit published4
Not applicable10
High6
Medium7
Low1
not blocked14
No public exploit14
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-61814 | High | 2026-09-23 | No exploit published | No public exploit | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0. |
| CVE-2026-59990 | High | 2026-09-23 | No exploit published | No public exploit | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0. |
| CVE-2026-54081 | Medium | 2026-07-29 | No exploit published | No public exploit | veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23. |
| CVE-2026-54080 | Medium | 2026-07-29 | No exploit published | No public exploit | veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23. |
| CVE-2026-46671 | Medium | 2026-07-20 | Not applicable | No public exploit | Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the `.onetoc2` and joins them against the notebook's base directory without validating that they are relative paths confined to that directory. The parser will bail out when the target file fails to parse as a OneNote section, so direct content exfiltration through the parser's return value is not practical, though file-existence probing and denial-of-service via large or special files remain possible. Anyone using `onenote_parser` to parse .onetoc2 files received from untrusted sources is affected. Users who only ever parse their own notebooks are not at meaningful risk. The issue is fixed in onenote_parser 1.1.1. The fix rejects absolute paths, parent-directory components, and other invalid path characters in entry names, and additionally canonicalises the resolved path to confirm it stays inside the notebook's base directory. For users who cannot upgrade to 1.1.1, only call `Parser::parse_notebook` on `.onetoc2` files from trusted sources. Alternatively, use `Parser::parse_section` / `Parser::parse_section_buffer` on individual .one files, which do not perform the directory walk. |
| CVE-2026-12590 | Medium | 2026-07-09 | Not applicable | No public exploit | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number. |
| CVE-2026-44928 | Medium | 2026-05-08 | Not applicable | No public exploit | In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. |
| CVE-2026-44927 | Medium | 2026-05-08 | Not applicable | No public exploit | In uriparser before 1.0.2, there is pointer difference truncation to int in various places. |
| CVE-2026-42371 | Medium | 2026-04-27 | Not applicable | No public exploit | uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes. |
| CVE-2026-33151 | High | 2026-03-20 | Not applicable | No public exploit | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6. |
| CVE-2026-27942 | Low | 2026-02-26 | Not applicable | No public exploit | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder. |
| CVE-2026-26278 | High | 2026-02-19 | Not applicable | No public exploit | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option. |
| CVE-2026-25762 | High | 2026-02-06 | Not applicable | No public exploit | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9. |
| CVE-2026-25754 | High | 2026-02-06 | Not applicable | No public exploit | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9. |
| CVE-2025-55322 | High | 2025-09-24 | Not applicable | No public exploit | Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. |
| CVE-2024-45590 | High | 2024-09-10 | Not applicable | No public exploit | body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3. |
| CVE-2024-41818 | High | 2024-07-29 | Not applicable | No public exploit | fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1. |
| CVE-2024-34403 | Medium | 2024-05-03 | Not applicable | No public exploit | An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string. |
| CVE-2024-34402 | High | 2024-05-03 | Not applicable | No public exploit | An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow. |
| CVE-2023-26920 | Medium | 2023-12-12 | No exploit published | No public exploit | fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. |
| CVE-2023-34104 | High | 2023-06-06 | Not applicable | No public exploit | fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option. |
| CVE-2023-32695 | High | 2023-05-27 | Not applicable | No public exploit | socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3. |
| CVE-2023-26479 | Medium | 2023-03-02 | No exploit published | No public exploit | XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index (if the page containing the faulty content is a user page) and the page index. Note that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert the change as the stack overflow is already triggered while getting the title of the document. This means that it is quite difficult to remove this content once inserted. This has been patched in XWiki 13.10.10, 14.4.6, and 14.9-rc-1. A temporary workaround to avoid Stack Overflow errors is to increase the memory allocated to the stack by using the `-Xss` JVM parameter (e.g., `-Xss32m`). This should allow the parser to pass and to fix the faulty content. The consequences for other aspects of the system (e.g., performance) are unknown, and this workaround should be only be used as a temporary solution. The workaround does not prevent the issue occurring again with other content. Consequently, it is strongly advised to upgrade to a version where the issue has been patched. |
| CVE-2023-1157 | Medium | 2023-03-02 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the file elf_parser.cpp. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-222222 is the identifier assigned to this vulnerability. |
| CVE-2023-23088 | Critical | 2023-02-03 | Not applicable | No public exploit | Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function. |
| CVE-2019-25078 | High | 2022-12-13 | Not applicable | No public exploit | A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443. |
| CVE-2022-23496 | High | 2022-12-08 | No exploit published | No public exploit | Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library. |
| CVE-2022-2421 | Critical | 2022-10-26 | Not applicable | No public exploit | Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. |
| CVE-2022-39280 | High | 2022-10-06 | Not applicable | No public exploit | dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed. |
| CVE-2020-28462 | Critical | 2022-07-25 | Not applicable | No public exploit | This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context. |
| CVE-2021-4229 | High | 2022-05-24 | Not applicable | No public exploit | A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component. |
| CVE-2021-46142 | Medium | 2022-01-06 | Not applicable | No public exploit | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. |
| CVE-2021-46141 | Medium | 2022-01-06 | Not applicable | No public exploit | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner. |
| CVE-2021-3666 | Critical | 2021-09-13 | Not applicable | No public exploit | body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
| CVE-2021-23416 | Medium | 2021-07-28 | Not applicable | No public exploit | This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input. |
| CVE-2021-27292 | High | 2021-03-17 | Not applicable | No public exploit | ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time. |
| CVE-2021-27405 | High | 2021-02-19 | Not applicable | No public exploit | A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. |
| CVE-2021-23328 | Medium | 2021-01-29 | Not applicable | No public exploit | This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. |
| CVE-2020-36049 | High | 2021-01-08 | Not applicable | No public exploit | socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. |
| CVE-2020-35381 | High | 2020-12-15 | Not applicable | No public exploit | jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. |
| CVE-2020-7793 | High | 2020-12-11 | Not applicable | No public exploit | The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). |
| CVE-2020-16161 | High | 2020-10-19 | Not applicable | No public exploit | GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_ScaledData(). Parsing malicious input can result in a crash. |
| CVE-2020-16160 | High | 2020-10-19 | Not applicable | No public exploit | GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_Decompress(). Parsing malicious input can result in a crash. |
| CVE-2020-16159 | Critical | 2020-10-19 | Not applicable | No public exploit | GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF_ScaledData(). Parsing malicious input can result in a crash or information disclosure. |
| CVE-2020-16158 | High | 2020-10-19 | Not applicable | No public exploit | GoPro gpmf-parser through 1.5 has a stack out-of-bounds write vulnerability in GPMF_ExpandComplexTYPE(). Parsing malicious input can result in a crash or potentially arbitrary code execution. |
| CVE-2020-7733 | High | 2020-09-16 | Not applicable | No public exploit | The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. |
| CVE-2020-7617 | Critical | 2020-04-02 | Not applicable | No public exploit | ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload. |
| CVE-2020-10675 | High | 2020-03-19 | Not applicable | No public exploit | The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. |
| CVE-2020-7608 | Medium | 2020-03-16 | Not applicable | No public exploit | yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. |
| CVE-2020-6836 | Critical | 2020-01-11 | Not applicable | No public exploit | grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server. |
| CVE-2019-20089 | High | 2019-12-30 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation. |
| CVE-2019-20088 | High | 2019-12-30 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c. |
| CVE-2019-20087 | High | 2019-12-30 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature. |
| CVE-2019-20086 | High | 2019-12-30 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c. |
| CVE-2019-18937 | Critical | 2019-11-14 | Not applicable | No public exploit | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request. |
| CVE-2019-18409 | High | 2019-10-24 | Not applicable | No public exploit | The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file. |
| CVE-2019-10410 | Medium | 2019-09-25 | No exploit published | No public exploit | Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules. |
| CVE-2019-15148 | Medium | 2019-08-18 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c. |
| CVE-2019-15147 | Medium | 2019-08-18 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c. |
| CVE-2019-15146 | Medium | 2019-08-18 | Not applicable | No public exploit | GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c. |
| CVE-2019-10093 | Medium | 2019-08-02 | No exploit published | No public exploit | In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later. |
| CVE-2018-20164 | Medium | 2019-02-13 | Not applicable | No public exploit | An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.) |
| CVE-2018-20721 | Critical | 2019-01-16 | Not applicable | No public exploit | URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address. |
| CVE-2018-17197 | Medium | 2018-12-24 | No exploit published | No public exploit | A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika. |
| CVE-2018-19200 | High | 2018-11-12 | Not applicable | No public exploit | An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function. |
| CVE-2018-19199 | Critical | 2018-11-12 | Not applicable | No public exploit | An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication. |
| CVE-2018-19198 | Critical | 2018-11-12 | Not applicable | No public exploit | An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts. |
| CVE-2018-18699 | High | 2018-10-29 | Not applicable | No public exploit | An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c. |
| CVE-2018-18190 | Medium | 2018-10-09 | Not applicable | No public exploit | An issue was discovered in GoPro gpmf-parser before 1.2.1. There is a divide-by-zero error in GPMF_ScaledData in GPMF_parser.c. |
| CVE-2018-14401 | High | 2018-07-19 | Not applicable | No public exploit | CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read. |
| CVE-2018-13421 | Critical | 2018-07-07 | Not applicable | No public exploit | Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h. |
| CVE-2018-13026 | Critical | 2018-06-30 | Not applicable | No public exploit | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type. |
| CVE-2018-13011 | Critical | 2018-06-29 | Not applicable | No public exploit | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate. |
| CVE-2018-13009 | Critical | 2018-06-29 | Not applicable | No public exploit | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check). |
| CVE-2018-13008 | Critical | 2018-06-29 | Not applicable | No public exploit | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level. |
| CVE-2018-13007 | Critical | 2018-06-29 | Not applicable | No public exploit | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check). |
| CVE-2017-16086 | High | 2018-06-07 | Not applicable | No public exploit | ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header. |
| CVE-2016-10660 | High | 2018-06-04 | Not applicable | No public exploit | fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10632 | High | 2018-06-01 | Not applicable | No public exploit | apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10574 | High | 2018-06-01 | Not applicable | No public exploit | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10564 | High | 2018-05-31 | Not applicable | No public exploit | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10666 | High | 2018-05-29 | Not applicable | No public exploit | tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2018-11128 | High | 2018-05-17 | Not applicable | No public exploit | The ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly execute arbitrary code via a crafted pdf file. |
| CVE-2018-1339 | Medium | 2018-04-25 | No exploit published | No public exploit | A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. |
| CVE-2018-7560 | High | 2018-03-04 | Not applicable | No public exploit | index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string. |
| CVE-2017-1000207 | High | 2017-11-27 | Protected by Waratek | No public exploit | A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. |
| CVE-2017-1000208 | High | 2017-11-17 | Protected by Waratek | No public exploit | A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. |
| CVE-2013-0162 | Low | 2013-03-01 | Not applicable | No public exploit | The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. |
| CVE-2012-2921 | Medium | 2012-05-21 | Not applicable | No public exploit | Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document. |
| CVE-2011-1158 | Medium | 2011-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI. |
| CVE-2011-1157 | Medium | 2011-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments. |
| CVE-2011-1156 | Medium | 2011-04-11 | Not applicable | No public exploit | feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration. |
| CVE-2009-3627 | Medium | 2009-10-29 | Not applicable | No public exploit | The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character. |
| CVE-2009-3198 | Medium | 2009-09-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. |
| CVE-2006-4686 | High | 2006-10-10 | Not applicable | No public exploit | Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page. |
| CVE-2006-4685 | Low | 2006-10-10 | Not applicable | No public exploit | The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains. |
| CVE-2006-1583 | Medium | 2006-04-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter. |
| CVE-1999-1378 | Medium | 1999-07-19 | Not applicable | No public exploit | dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files. |