Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Lilypond Clear all filters
TI-2020-13132 CVE-2020-17354 · GHSA-vm3h-24gm-v3q6

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via…

Priority HIGH 72

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution durin…

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00414 Published 2023-04-15 No fix listed CWE-863
TI-2018-07791 CVE-2018-10992 · GHSA-62j8-9w4c-7rfw

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the…

Priority MEDIUM 45

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a c…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01463 Published 2018-05-11 No fix listed CWE-88
TI-2017-12800 CVE-2017-17523 · GHSA-wwvq-3fw5-hw34

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the…

Priority MEDIUM 42

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a c…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02108 Published 2017-12-11 No fix listed CWE-74