CWE-122 · Heap-based Buffer Overflow (page 31)
Page 31 of 33 — CVEs classified under CWE-122, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25668 | Critical | 9.8 | 2021-04-22 | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT PRO (All… |
CVE-2021-29457 | High | 7.8 | 2021-04-19 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in… |
CVE-2021-27253 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is… |
CVE-2021-25360 | Critical | 9.0 | 2021-04-09 | An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextra… |
CVE-2020-27829 | Medium | 5.5 | 2021-03-26 | A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45. |
CVE-2021-29097 | High | 7.8 | 2021-03-25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS… |
CVE-2020-7852 | High | 7.8 | 2021-03-24 | DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed ex.j2c format file that is mishandled by Daview.exe. Attackers co… |
CVE-2021-21077 | High | 7.8 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-24025 | Critical | 9.8 | 2021-03-10 | Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading t… |
CVE-2020-1917 | Critical | 9.8 | 2021-03-10 | xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard appen… |
CVE-2020-1916 | Critical | 9.8 | 2021-03-10 | An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This iss… |
CVE-2020-28587 | High | 7.8 | 2021-02-23 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is small… |
CVE-2021-20587 | High | 7.5 | 2021-02-19 | Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Co… |
CVE-2021-21017 | High | 8.8 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based bu… |
CVE-2020-28595 | High | 7.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specia… |
CVE-2020-27250 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a part… |
CVE-2020-13581 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a part… |
CVE-2020-13572 | High | 8.8 | 2021-02-10 | A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file ca… |
CVE-2020-17423 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-27249 | High | 7.8 | 2021-02-04 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is small… |
CVE-2020-27248 | High | 7.8 | 2021-02-04 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is small… |
CVE-2020-27247 | High | 7.8 | 2021-02-04 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is small… |
CVE-2020-13586 | High | 7.8 | 2021-02-04 | A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revi… |
CVE-2021-22641 | High | 7.8 | 2021-01-27 | A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file… |
CVE-2020-27297 | Critical | 9.8 | 2021-01-26 | The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execut… |
CVE-2020-27814 | High | 7.8 | 2021-01-26 | A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in som… |
CVE-2020-25687 | Medium | 5.9 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the rece… |
CVE-2020-25682 | High | 8.1 | 2021-01-20 | A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating the… |
CVE-2020-25681 | High | 8.1 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. A… |
CVE-2020-25683 | Medium | 5.9 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the rece… |
CVE-2020-27263 | Critical | 9.1 | 2021-01-14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut… |
CVE-2021-21006 | High | 8.6 | 2021-01-13 | Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially crafted font file. Successful exploita… |
CVE-2020-26994 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26987 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26986 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26985 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-25226 | Critical | 9.8 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-15800 | Critical | 9.8 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-27841 | Medium | 5.5 | 2021-01-05 | There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpe… |
CVE-2020-25843 | High | 8.1 | 2020-12-31 | NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to… |
CVE-2020-25712 | High | 7.8 | 2020-12-15 | A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest th… |
CVE-2020-25187 | High | 8.8 | 2020-12-14 | Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap… |
CVE-2020-25199 | High | 7.8 | 2020-12-09 | A heap-based buffer overflow vulnerability exists within the WECON LeviStudioU Release Build 2019-09-21 and prior when processing project files. Opening a spec… |
CVE-2020-27752 | High | 7.1 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap b… |
CVE-2020-25674 | Medium | 5.5 | 2020-12-08 | WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overfl… |
CVE-2020-25667 | Medium | 5.5 | 2020-12-08 | TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due… |
CVE-2020-25665 | Medium | 5.5 | 2020-12-08 | The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This c… |
CVE-2020-25664 | Medium | 6.1 | 2020-12-08 | In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when Po… |
CVE-2020-13494 | Medium | 5.5 | 2020-12-02 | A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can… |
CVE-2020-13493 | High | 7.8 | 2020-12-02 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file for… |
CVE-2020-25181 | High | 8.8 | 2020-12-01 | WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution. |
CVE-2020-27255 | High | 7.5 | 2020-11-26 | A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send… |
CVE-2020-27251 | Critical | 9.8 | 2020-11-26 | A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send… |
CVE-2020-6156 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, th… |
CVE-2020-6155 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed fi… |
CVE-2020-6150 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. |
CVE-2020-6149 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, th… |
CVE-2020-6148 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file f… |
CVE-2020-6147 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC… |
CVE-2020-24435 | High | 7.8 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer over… |
CVE-2020-16010 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-5138 | High | 7.5 | 2020-10-12 | A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads… |
CVE-2020-1906 | High | 7.8 | 2020-10-06 | A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when… |
CVE-2020-15205 | Critical | 9.0 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a us… |
CVE-2020-15201 | Medium | 4.8 | 2020-09-25 | In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In part… |
CVE-2020-15200 | Medium | 5.9 | 2020-09-25 | In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In part… |
CVE-2020-15198 | Medium | 5.4 | 2020-09-25 | In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In part… |
CVE-2020-15196 | High | 8.5 | 2020-09-25 | In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same… |
CVE-2020-15195 | High | 8.5 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is poss… |
CVE-2020-6146 | High | 8.8 | 2020-09-16 | An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300. When drawing the contents of a page… |
CVE-2020-15158 | High | 7.7 | 2020-08-26 | In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap… |
CVE-2020-14524 | Critical | 9.8 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, whi… |
CVE-2020-16223 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful ex… |
CVE-2020-16207 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafte… |
CVE-2020-14311 | Medium | 5.7 | 2020-07-31 | There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT3… |
CVE-2020-14310 | Medium | 5.7 | 2020-07-31 | There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it… |
CVE-2020-7829 | High | 7.8 | 2020-07-30 | DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by… |
CVE-2020-7828 | High | 7.8 | 2020-07-30 | DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by… |
CVE-2020-10928 | High | 8.4 | 2020-07-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentica… |
CVE-2020-11061 | Medium | 6.0 | 2020-07-10 | In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via ov… |
CVE-2020-14482 | High | 7.8 | 2020-06-30 | Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap, which may allow remote code… |
CVE-2020-4068 | Medium | 6.3 | 2020-06-22 | In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1. |
CVE-2020-7586 | High | 7.8 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions <… |
CVE-2020-10638 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validati… |
CVE-2020-8899 | Critical | 9.8 | 2020-05-06 | There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorize… |
CVE-2020-10896 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10646 | High | 7.8 | 2020-04-13 | Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when parsing VPR files, is… |
CVE-2020-6970 | Critical | 9.8 | 2020-02-19 | A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all ver… |
CVE-2020-1711 | High | 7.7 | 2020-02-11 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSC… |
CVE-2019-9502 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer over… |
CVE-2019-9501 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap… |
CVE-2020-6007 | High | 7.9 | 2020-01-23 | Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commiss… |
CVE-2019-9500 | High | 7.9 | 2020-01-16 | The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless… |
CVE-2019-15694 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to th… |
CVE-2019-15693 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could… |
CVE-2019-15692 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Ex… |
CVE-2019-16778 | Low | 2.6 | 2019-12-16 | In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and n… |
CVE-2019-18330 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a De… |
CVE-2019-18329 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18328 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |