2875 matches found
TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution
Cybersecurity researchers have disclosed details of a high-severity flaw impacting the popular async-tar Rust library and its forks, including tokio-tar, that could result in remote code execution under certain conditions. The vulnerability, tracked as CVE-2025-62518 CVSS score: 8.1, has been...
CVE-2025-62518
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives...
CVE-2025-11678
Stack-based Buffer Overflow in lwsadnsparselabel in warmcat libwebsockets allows, when the LWSWITHSYSASYNCDNS flag is enabled during compilation, to overflow the labelstack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer...
CVE-2025-11678 Stack-based Buffer Overflow in libwebsockets DNS response parsing
Stack-based Buffer Overflow in lwsadnsparselabel in warmcat libwebsockets allows, when the LWSWITHSYSASYNCDNS flag is enabled during compilation, to overflow the labelstack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer...
PT-2025-42761
Name of the Vulnerable Software and Affected Versions libwebsockets affected versions not specified Description A stack-based buffer overflow exists in the lws adns parse label function within libwebsockets. This occurs when the LWS WITH SYS ASYNC DNS flag is enabled during compilation and an...
CVE-2020-36854
The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...
CVE-2020-36854
The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...
WordPress plugin Async JavaScript 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-site...
PT-2025-42672
Name of the Vulnerable Software and Affected Versions Async JavaScript plugin for WordPress versions prior to 2.19.07.14 Description The software is susceptible to Stored Cross-Site Scripting due to missing authorization checks on the aj steps AJAX action and insufficient sanitization of settings...
CVE-2020-36854: Improper Neutralization of Input During Web Page Generation
The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...
RHSA-2025:17614 Red Hat Security Advisory: Satellite 6.15.5.5 Async Update
Bulletin has no description...
RHSA-2025:17613 Red Hat Security Advisory: Satellite 6.16.5.4 Async Update
Bulletin has no description...
RHSA-2025:17606 Red Hat Security Advisory: Satellite 6.17.5 Async Update
Bulletin has no description...
Malicious code in async-chai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 219d4f4b2ee4a3b5ad9499a019b0f6ce848b7ae5bdc38e72e6c68c24b2ba3c77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-32990
Malicious code in async-chai npm...
Malicious Package
Overview async-chai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malware in async-chai
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-48014 Malicious code in async-chai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 219d4f4b2ee4a3b5ad9499a019b0f6ce848b7ae5bdc38e72e6c68c24b2ba3c77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...