3043 matches found
CVE-2025-52557
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...
CVE-2025-6466 ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload
A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File...
CVE-2025-52557
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...
CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...
CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...
CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email
Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...
PT-2025-26486 · Unknown · Mail-0'S Zero
Name of the Vulnerable Software and Affected Versions: Mail-0's Zero versions 0.8 Description: The issue is related to improper sanitization, allowing an attacker to craft an email that executes javascript, leading to session hijacking. This is a Stored XSS Vulnerability in the Mail-0's Zero Emai...
Jetimob Plataforma Imobiliaria 跨站脚本漏洞
Jetimob Plataforma Imobiliaria is a real estate platform from Jetimob Brazil. A cross-site scripting vulnerability exists in Jetimob Plataforma Imobiliaria version 20240627-0, which stems from a cross-site scripting vulnerability in the Ttulo field of the Busca function, which could lead to the...
Jetimob Plataforma Imobiliaria 跨站脚本漏洞
Jetimob Plataforma Imobiliaria is a real estate platform from Jetimob Brazil. A cross-site scripting vulnerability exists in Jetimob Plataforma Imobiliaria version 20240627-0, which stems from a cross-site scripting vulnerability in the Profisso field of the Pessoas section, which could lead to t...
CVE-2025-1750 SQL Injection in run-llama/llama_index
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llamaindex version v0.12.19. This vulnerability allows an attacker to manipulate the refdocid parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code...
CVE-2025-47288
Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1....
📄 Automic Agent 24.3.0 HF4 Privilege Escalation
Automic Agent version 24.3.0 HF4 suffers from a privilege escalation vulnerability. Exploit Title: Automic Agent 24.3.0 HF4 - Privilege Escalation Date: 26.05.2025 Exploit Author: Flora Schäfer Vendor Homepage: https://www.broadcom.com/products/software/automation/automic-automation Version:...
The vulnerability of the gfx_v11_0_hw_init() function in the DRI support driver for AMD GPU cores in Linux operating systems allows a hacker to cause a system failure.
The vulnerability of the gfxv110hwinit function in the DRI support driver for AMD GPU cores in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2025-24800
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or...
CVE-2024-45397
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by...
CVE-2024-45384
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not usin...
CVE-2024-24425
Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amfasestablishreq function at /tasks/amf/amfas.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted NAS packet...
CVE-2024-51751
Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary file...