1417 matches found
CVE-2021-4396
The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the savercpostmeta function. This makes it possible for unauthenticated attackers to save post meta via a forged request grant...
CVE-2010-3300
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks...
CVE-2014-125002
A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhdinitrc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue...
CVE-2017-20057
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting Persistent. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to addres...
SUSE-SU-2025:01627-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2025-21726: padata: avoid UAF for reorderwork bsc1238865. - CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array bsc1238747. -...
Milesight UG65-868M-EA security vulnerabilities
The Milesight UG65-868M-EA is a ruggedized indoor and semi-outdoor LoRaWAN gateway from China-based Milesight. A security vulnerability exists in the Milesight UG65-868M-EA prior to version 60.0.0.46, which originates from an administrator user being able to write unauthorized access to the...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...
Malicious code in @mstrlibrary/rc-slider (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-3705 Malicious code in @mstrlibrary/rc-slider (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-32974 org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page...
XWiki Platform security vulnerabilities
XWiki Platform is the XWiki open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions prior to 15.10.12, prior to 16.4.3, and prior to 16.8.0-rc-1, which stems from an improper check of the LESS compiler permissions...
AZL-60928 CVE-2025-3576 affecting package krb5 for versions less than 1.19.4-4
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This ma...
CVE-2025-29570
An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftpimagecheck of a binary named rc...
PT-2025-14789 · Unknown · Lbt-T300-T400
Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 version 3.2 Description: An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 version 3.2 allows a local attacker to escalate privileges via the tftp image check function of a binar...
Shenzhen Libituo Technology LBT-T300-T400 security vulnerabilities
Shenzhen Libituo Technology LBT-T300-T400 is an industrial router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-T400 version 3.2, which stems from a flaw in the tftpimagecheck function in the rc binary, which could lead to...
CVE-2025-29570
A privilege escalation vulnerability exists in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 , an industrial router. The flaw is located within the tftp_image_check function of the rc binary, which allows a local attacker to gain elevated privileges. The vulnerability is categorized und...
PT-2025-12722
Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could...