FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Information Disclosure
Use After Free
Memory Corruption
Debian
Canonical
+3
NVD
GitHub
CVSS 3.1
5.5
EPSS
1.3%
HESK before 3.1.10 allows reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
Hesk
NVD
CVSS 3.1
6.1
EPSS
0.6%