Nih vulnerabilities
10 vulnerabilities
Known vulnerabilities in Nih products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Libzip3 vulnerabilities
- Ncbi Toolbox3 vulnerabilities
- Brics2 vulnerabilities
- Libdicom2 vulnerabilities
RoutineCVE-2025-27581nih · bricsnih bricsNIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.CVSS4.3MediumEPSS0.38%RoutineCVE-2025-27580nih · bricsnih bricsNIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.CVSS7.5HighEPSS0.72%PrioritiseCVE-2024-24794imaging data commons · libdicom +1 moreimaging data commons libdicomA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_sequence_end()` parsing the Sequence Value Represenations.CVSS9.8CriticalEPSS1.05%PrioritiseCVE-2024-24793imaging data commons · libdicom +1 moreimaging data commons libdicomA use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_element_create()` parsing the elements in the File Meta Information header.CVSS9.8CriticalEPSS1.05%RoutineCVE-2018-16718nih · ncbi_toolboxnih ncbi_toolboxAn XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.CVSS6.1MediumEPSS0.84%PrioritiseCVE-2018-16717nih · ncbi_toolboxnih ncbi_toolboxA heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox.CVSS9.8CriticalEPSS1.59%PrioritiseCVE-2018-16716nih · ncbi_toolboxnih ncbi_toolboxA path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.CVSS9.1CriticalEPSS8.57%PrioritiseCVE-2015-2331debian · debian_linux +11 moredebian debian_linuxInteger overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.CVSS7.5HighEPSS27.39%RoutineCVE-2012-1163nih · libzip +1 morenih libzipInteger overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.CVSS6.8MediumEPSS2.58%PrioritiseCVE-2012-1162nih · libzip +1 morenih libzipHeap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct."CVSS7.5HighEPSS4.03%