CVE and Aspose.Words

[johndie]

Are you going to issue a CVE regarding those issues?

[tahir.manzoor]

@johndie

The issue WORDSJAVA-1663 had been closed. Could you please share some more detail about your query? We will then provide you more information about it.

[johndie]

You didn’t share any details about the bugs fixed and the VeraCode report is private. How people with older versions of Aspose can know their exposure to those issues?
This is the purpose of responsible disclosure procedure. Can you please share more information about the problems that were fixed?

[tahir.manzoor]

@johndie

The issues reported in the following thread had been fixed about ‘Veracode Security Scan report’. Please get the detail from here:

Static code scans of Aspose.Words

Aspose Support: We are about to purchase Aspose.Words Java and we were wondering if Aspose was running static code scans on Aspose.Words as a practice before releasing it to the world. Everything we put into our software has to go through static code scans. I saw other customers reporting in this forum that they had run Veracode against some Aspose products themselves, and you seemed to be pretty responsive about the vulnerabilities reported, but I was wondering if it was standard practice at A…