1276 matches found
external_expat-2.1.0_CVE-2022-43680
Expat, リリース 2.1.0 これはExpat、James Clarkによって書かれたXMLを解析するためのCライブラリです。 Expatはストリーム指向のXMLパーサーです。つまり、解析を開始する前にパーサーにハンドラーを登録します。これらのハンドラーは、パーサーが解析中のドキュメント内で関連する構造を発見したときに呼び出されます。開始タグは、ハンドラーを登録できる構造の一例です。 Windowsユーザーは、expatwin32binパッケージを使用してください。これには、プリコンパイルされたライブラリと実行可能ファイル、および開発者向けのソースコードが含まれています。...
CVE-2026-3304
CVE-2026-3304 실습 환경 교육 및 연구 목적으로만 사용하십시오. 승인 없이 시스템을 공격하는 것은 불법입니다. 이 실습 환경은 Multer 2.1.0 패치와 공식 테스트 코드를 분석하여 구축되었습니다. 취약한 서버는 패치 테스트에 설명된 정확한 조건을 재현하며, 패치된 서버는 Multer 2.1.0을 실행하여 수정 사항이 작동하는지 확인합니다. 취약점 개요 필드| 세부 정보 ---|--- CVE| CVE-2026-3304 대상| Multer 열림, 데이터 쓰기 시작 3. 파트 2 헤더 수신 name 속성 누락 →...
expat_2_1_0_CVE-2024-28757
Expat, 릴리스 2.1.0 이것은 James Clark이 작성한 XML 파싱용 C 라이브러리인 Expat입니다. Expat은 스트림 지향stream-oriented XML 파서입니다. 즉, 파싱을 시작하기 전에 파서에 핸들러를 등록한다는 뜻입니다. 이 핸들러들은 파서가 파싱 중인 문서에서 해당 구조를 발견할 때 호출됩니다. 시작 태그start tag는 핸들러를 등록할 수 있는 구조의 한 예입니다. Windows 사용자는 expatwin32bin 패키지를 사용해야 합니다. 이 패키지에는 사전 컴파일된 라이브러리와 실행 파일,...
CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...
CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...
CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...
EUVD-2026-83796
A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function loadinfo/readtorchdata of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was...
CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability
tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...
Astra Linux – Vulnerability in yajl
There is a memory leak in yajl 2.1.0 when using the yajltreeparse function. This can lead to out-of-memory issues on the server and cause crashes...
openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21816-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21816-1 advisory. Changes in hauler: Update to 2.1.0 bsc1265425, CVE-2026-41888, bsc1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, . Tenable has extracted...
OPENSUSE-SU-2026:21816-1 Security update for hauler
This update for hauler fixes the following issues: Changes in hauler: Update to 2.1.0 bsc1265425, CVE-2026-41888, bsc1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662,...
CVE-2026-81160: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-82667 yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery
A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-72588
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...
EUVD-2026-55218
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...
CVE-2026-10595
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...
CLSA-2026-1784596327 TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.0-tuxcare.1...