astral-tokio-tar 安全漏洞

astral-tokio-tar is a Rust library open-sourced by Astral. A security vulnerability exists in astral-tokio-tar 0.5.3 and earlier versions, which stems from a path traversal issue in the Entryunpackinraw API and the Entryallowexternalsymlinks control that can be bypassed, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2020-25573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint...

Linux Distros Unpatched Vulnerability : CVE-2022-38223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an...

Linux Distros Unpatched Vulnerability : CVE-2021-21235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specificall...

Linux Distros Unpatched Vulnerability : CVE-2017-11692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The function Token& Scanner::peek in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service assertion failure and...

Linux Distros Unpatched Vulnerability : CVE-2017-5950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and applicatio...

SUSE CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GHSA-H3QP-HWVR-9XCQ Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the processing of OpenID Connect tokens. An attacker can access internal network resources and potentially obtain sensitive information by submitting specially crafted tokens that trigger unauthorize...

CVE-2024-53760

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Capitalize My Title Capitalize My Title capitalize-my-title allows Stored XSS.This issue affects Capitalize My Title: from n/a through = 0.5.3...

CVE-2023-3491

Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3...

CVE-2021-21235

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround i...

CVE-2020-15141

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk...

CVE-2025-32478

Cross-Site Request Forgery CSRF vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through = 0.5.3...

CVE-2025-32478

Cross-Site Request Forgery CSRF vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through = 0.5.3...

CVE-2025-32478 WordPress WP SexyLightBox plugin <= 0.5.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through = 0.5.3...

CVE-2025-32478

CVE-2025-32478 : Wordfence/EU product data confirms a vulnerability in the WP SexyLightBox plugin (affected: WP SexyLightBox

CVE-2025-30874

Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specific Content For Mobile: from n/a through = 0.5.3...

WordPress Specific Content For Mobile plugin <= 0.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin Specific Content For Mobile versions = 0.5.3...

youki 安全漏洞

youki is a youki open source implementation of the OCI runtime specification in Rust. A security vulnerability exists in versions of youki prior to 0.5.3 that stems from a tenant builder accepting a list of features to be added to the tenant container specification during the creation of a tenant...