FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Use After Free
Memory Corruption
Information Disclosure
Ffmpeg
Ubuntu Linux
+1
NVD
GitHub
CVSS 3.1
5.5
EPSS
1.3%
HESK before 3.1.10 allows reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
Hesk
NVD
CVSS 3.1
6.1
EPSS
0.6%