Affected: unknown SCHUTZWERK-SA-2024-007
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Metadata ========
- - Affected product: h5p-nodejs-library
the time of publication) - - Vendor: Lumi Education UG - - Problem type(s):
- CWE-20 Improper Input Validation - - CVE ID: CVE-2025-7062 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-7062 - - CVSS 4.0 score: 5.2 - - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/
Details =======
content/content.json file.
content:
<?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg version="1.1" id="svg2" sodipodi:docname="circle.svg" xmlns="http://www.w3.org/2000/svg"; xmlns:svg="http://www.w3.org/2000/svg";> <script>alert("XSS Test");</script> <script>alert(document.cookie);</script> <circle
id="path233" cx="98.428535" cy="68.415733" r="54.194405" /> </svg>
content/content.json as follows:
{ "media": { "type": { "params": { "decorative": false, "contentName": "Image", "expandImage": "Expand Image", "minimizeImage": "Minimize Image", "file": { "path": "images/circle.svg", "mime": "image/svg+xml", [...]
window.
Risk ====
additional roles to existing ones.
Solution/Mitigation ===================
allowed extension, such as XML, and have it executed.
from uploaded files.
Timeline ========
- - 2024-10-23 Vulnerability discovered - - 2024-11-08 Initial contact attempt, email sent to c@lumi.education
- -…
Affected: unknown usvg SVGZ decompression
# usvg SVGZ decompression bomb in `Tree::from_data`
**Author:** Khashayar Fereidani **Disclosure Date:** 2026-09-18 **Advisory:** https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata **Contact:** https://fereidani.com/contact
## Description
`Tree::from_data` in `crates/usvg/src/parser/mod.rs:102` detects the gzip magic bytes at the start of the input and decompresses the data before parsing it:
```rust // crates/usvg/src/parser/mod.rs:109 let data = decompress_svgz(data)?; let text = std::str::from_utf8(&data).map_err(|_| Error::NotAnUtf8Str)?; Self::from_str(text, opt) ```
```rust // crates/usvg/src/parser/mod.rs:180 pub fn decompress_svgz(data: &[u8]) -> Result<Vec<u8>, Error> { use std::io::Read;
let mut decoder = flate2::read::GzDecoder::new(data); let mut decoded = Vec::with_capacity(data.len() * 2); decoder .read_to_end(&mut decoded) .map_err(|_| Error::MalformedGZip)?; Ok(decoded) } ```
`read_to_end` grows `decoded` with no cap on the output size, and the whole buffer is materialized before `from_str` reads the first byte. The attacker fully controls the expansion ratio, since gzip reaches roughly 1000:1, so the size of the input places no bound on the size of the allocation. A payload of a few hundred kilobytes can request several gigabytes of memory, and the parse error only fires after the entire bomb is already in memory.
## Proof of concept
Create a new project with `flate2` and `usvg`:
```toml [dependen…
Affected: unknown GDCM (Grassroots DICOM)
Advisory ID: SYSS-2026-071 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Format String (CWE-134) Risk Level: Medium Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]).
The gdcmFilenameGenerator component, used by the gdcmraw command-line tool to generate output filenames for split fragments, is vulnerable to a format string vulnerability. The user-supplied pattern string is used directly as the format string argument to snprintf() without proper validation of the format specifiers. Only the count of % characters is checked (exactly one required), but the specifier that follows is not validated.
An attacker can supply format specifiers such as "%n" to write to arbitrary memory addresses, or "%s" to dereference small integers as pointers, causing crashes. Positional parameters like "%5$x" can be used to leak stack data into generated filenames, enabling information disclosure.
~~~~~~~~~~~~~~~~~~~~~~~~…
Affected: unknown GDCM (Grassroots DICOM)
Advisory ID: SYSS-2026-070 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Integer Overflow (CWE-190) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]).
The gdcmstream command-line tool, used for stream-based reading and writing of DICOM images, is vulnerable to an integer overflow that leads to a heap buffer overflow.
When processing JPEG2000-compressed DICOM files, the gdcmstream tool decodes the embedded JPEG2000 codestream via OpenJPEG and allocates a buffer for the raw pixel data. The buffer size is computed using 32-bit integer arithmetic
the product exceeds 2^32, the result silently wraps around, causing an undersized buffer allocation. The subsequent pixel data write loop then overflows the heap buffer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The vulnerable code is in the Write_Resolution function at Applications/Cxx/…
Affected: unknown GDCM (Grassroots DICOM)
Advisory ID: SYSS-2026-069 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Integer Overflow (CWE-190) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]).
The JPEG2000 image codec in GDCM, used for decoding JPEG2000-compressed DICOM pixel data, is vulnerable to an integer overflow that leads to a heap buffer overflow. The buffer size for decoded pixel data is computed using 32-bit unsigned integer arithmetic based on image dimensions (rows * columns) from the DICOM header. When the product exceeds 2^32, the result silently wraps around, causing an undersized buffer allocation. The subsequent pixel data write loop then overflows the heap buffer. A malicious DICOM file with crafted image dimensions can trigger this vulnerability, potentially leading to remote code execution in the context of the user processing the file.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…
Affected: unknown GDCM (Grassroots DICOM)
Advisory ID: SYSS-2026-068 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]).
The library function gdcm::System::EncodeBytes, defined in Source/Common/gdcmSystem.cxx, is vulnerable to a stack-based buffer overflow. The function uses a fixed-size 32-byte stack buffer and copies caller-provided data into it via memcpy() without checking the size parameter against the buffer capacity. If a caller invokes EncodeBytes with a size value greater than 32, a stack buffer overflow occurs, potentially leading to a process crash or arbitrary code execution in the context of the user running the application.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The EncodeBytes function is a public static method of the gdcm::System class (declared in Source/Common/gdcmSy…
Affected: unknown GDCM (Grassroots DICOM)
Advisory ID: SYSS-2026-067 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]).
GDCM's command-line tool gdcmxml, which converts between XML and DICOM file formats, is vulnerable to a stack-based buffer overflow in the LoadValueInteger macro. An attacker who can control the XML input supplied to the gdcmxml command-line application can cause an unbounded stack buffer overflow, potentially leading to a process crash or arbitrary code execution in the context of the user running the application.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The gdcmxml application (Applications/Cxx/gdcmxml.cxx) contains a series of macros for loading DICOM attribute values from XML, including LoadValueInteger (line 344), LoadValueFloat (line 374), and LoadValueDouble (l…
Affected: Honeywell IQ MultiAccess Update Service
SEC Consult Vulnerability Lab Security Advisory < 20260923-0 > ======================================================================= title: Local Privilege Escalation product: Honeywell IQ MultiAccess Update Service vulnerable version: IQ V27 & IQ V28 fixed version: IQ V27 SP1 & IQ V28 SP1 CVE number: CVE-2026-13742 impact: high homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess found: 2026-03-19 by: J. Kruchem (Office Vienna) G. Jank (Office Vienna) SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description: ------------------- "IQ MultiAccess is a highly scalable access control software solution suitable for controlling multiple locations within a company or several companies within a building complex/business park."
Source:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess
Business recommendation: ------------------------ The vendor provides patched versions which should be installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security profession…
Affected: unknown SCHUTZWERK-SA-2024-006
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
executed in victims' browsers when viewing the affected H5P content.
Metadata ========
- - Affected product: h5p-nodejs-library - - Affected version: All versions prior to 9.3.3 - - Vendor: Lumi Education UG - - Problem type(s):
- - CVE ID: CVE-2025-47828 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-47828 - - CVSS 3.1 score: 6.4 (Medium) - - CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-006/
Details =======
therefore store arbitrary HTML and JavaScript in these fields.
JavaScript alert function:
POST /api/v3/h5p-editor/edit/670e69f55301ad663ba69f9e HTTP/2 Host: example.com [...]
{ "library": "H5P.Timeline 1.1", "params": { "params": { "timeline": { "defaultZoomLevel": "0", "height": 600, "asset": { "media": "<script>alert('Alert from media')</script>", "credit": "<script>alert('Alert from media')</script>", "caption": "<script>alert('Alert from media')</script>" }, "date": [ { "asset": {}, "text": "<p>SW_BodyText2</p>\n", "startDate": "1900", "endDate": "9999", "headline": "SW_HEADLINE2", "tag": "SW_tags" } ], "language": "en", "headline": "SW_Headline", "text": "<div>SW_BodyText</div>" } }, "metadata"…
Affected: unknown Server Technology PRO3X
0day Rubbish Research Team is publicly disclosing a vulnerability in Server Technology (Legrand group) PRO3X series intelligent rack PDUs, firmware spdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).
Type: authenticated listener program override leading to root command execution (CWE-78, CWE-269; a separate hard-coded factory credential is reported as CWE-798). PRO3X PDUs run port_mux, an inetd-style launcher that starts every protocol listener with fork + execv and never drops privileges, so listeners run as root. The executable path is proto_listener_entry.program in cfg_pmux.cdl, typed nctl_nspc_nempty_str_512, a free-form string with no whitelist, and an authenticated administrator rewrites it through setConfiguration (POST /J/cfg). Pointing the port 80 http listener at /bin/sh with arguments -c "<cmd>" applies at runtime: the next TCP connection to port 80 executes the attacker's command as uid 0.
Scoring. This finding is dual-scored, with the conditional figure published alongside the primary: - PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. An authenticated administrator is required, and that gate was verified unbypassed. - CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Where the factory default administrator credential is left unchanged, unrotated units are open with no privileged secret.
Impact: root (uid 0) on the rack power distribution controller, a critical-infrastructure power monitoring and control appl…