Calibre-ebook

Calibre

10 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2024-7009

Exploit
  • EPSS 9.33%
  • Veröffentlicht 06.08.2024 04:16:47
  • Zuletzt bearbeitet 19.08.2024 17:18:50

Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.

7.5

CVE-2024-6781

  • EPSS 93.63%
  • Veröffentlicht 06.08.2024 04:16:46
  • Zuletzt bearbeitet 19.08.2024 17:15:34

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

6.1

CVE-2024-7008

Exploit
  • EPSS 9.57%
  • Veröffentlicht 06.08.2024 04:16:46
  • Zuletzt bearbeitet 19.08.2024 17:19:25

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

7.5

CVE-2023-46303

Exploit
  • EPSS 0.53%
  • Veröffentlicht 22.10.2023 18:15:08
  • Zuletzt bearbeitet 21.11.2024 08:28:15

link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.

7.5

CVE-2021-44686

Exploit
  • EPSS 0.33%
  • Veröffentlicht 07.12.2021 00:15:08
  • Zuletzt bearbeitet 21.11.2024 06:31:23

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.

9.3

CVE-2011-4126

Exploit
  • EPSS 0.47%
  • Veröffentlicht 27.10.2021 01:15:07
  • Zuletzt bearbeitet 21.11.2024 01:31:53

Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.

10

CVE-2011-4124

Exploit
  • EPSS 0.61%
  • Veröffentlicht 27.10.2021 01:15:06
  • Zuletzt bearbeitet 21.11.2024 01:31:53

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.

10

CVE-2011-4125

Exploit
  • EPSS 0.71%
  • Veröffentlicht 27.10.2021 01:15:06
  • Zuletzt bearbeitet 21.11.2024 01:31:53

A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.

7.8

CVE-2018-7889

Exploit
  • EPSS 3.32%
  • Veröffentlicht 08.03.2018 21:29:00
  • Zuletzt bearbeitet 21.11.2024 04:12:55

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

5.5

CVE-2016-10187

Exploit
  • EPSS 0.34%
  • Veröffentlicht 16.03.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.