Jetimob Plataforma Imobiliaria 跨站脚本漏洞

Jetimob Plataforma Imobiliaria is a real estate platform from Jetimob Brazil. A cross-site scripting vulnerability exists in Jetimob Plataforma Imobiliaria version 20240627-0, which stems from a cross-site scripting vulnerability in the Profisso field of the Pessoas section, which could lead to t...

CVE-2025-1750 SQL Injection in run-llama/llama_index

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llamaindex version v0.12.19. This vulnerability allows an attacker to manipulate the refdocid parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code...

CVE-2025-47288

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1....

📄 Automic Agent 24.3.0 HF4 Privilege Escalation

Automic Agent version 24.3.0 HF4 suffers from a privilege escalation vulnerability. Exploit Title: Automic Agent 24.3.0 HF4 - Privilege Escalation Date: 26.05.2025 Exploit Author: Flora Schäfer Vendor Homepage: https://www.broadcom.com/products/software/automation/automic-automation Version:...

The vulnerability of the gfx_v11_0_hw_init() function in the DRI support driver for AMD GPU cores in Linux operating systems allows a hacker to cause a system failure.

The vulnerability of the gfxv110hwinit function in the DRI support driver for AMD GPU cores in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-24800

Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or...

CVE-2024-45397

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by...

CVE-2024-45384

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not usin...

CVE-2024-24425

Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amfasestablishreq function at /tasks/amf/amfas.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted NAS packet...

CVE-2024-51751

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary file...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

CVE-2023-29994

In NanoMQ v0.15.0-0, Heap overflow occurs in readbyte function of mqttcode.c...

CVE-2023-3975

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

CVE-2022-32374

itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getsubjectrouting.php?id=...

CVE-2021-38311

In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessiv...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2020-9972

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution...

CVE-2020-20300

SQL injection vulnerability in the wpwhere function in WeiPHP 5.0...

CVE-2019-10708

S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...

au.com.versent.jenkins.plugins:ignore-committer-strategy (=29.v7c3891a_434c3), ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0 <=3.33.0) +709 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (>=6.0.0.202111291000-r <=6.10.0.202406032230-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version =6.0.0.202111291000-r, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0, =1.5.0, =1.15.2 - com.a65apps.changelog:com.a65apps.changelog.gradle.plugin =1.1.10 - com.a65apps.changelog:plugin =1.1.10 -...