Dragonfly 代码问题漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A code issue vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from a function returning an error but still dereferencing the first return value, potentially resulting i...

PT-2025-38259

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description The processPieceFromSource method in Dragonfly does not correctly update the usedTraffic field within the Task structure due to the use of an uninitialized variable n instead of result.Size when...

PT-2025-38273

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly2 uses the MD5 hash function for downloaded files, which does not provide collision resistance. This allows attackers to replace files with malicious ones that have a colliding hash. An...

PT-2025-38262

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly is a P2P-based file distribution and image acceleration system. Prior to version 2.1.0, the first return value of a function is dereferenced even when the function returns an error,...

PT-2025-38274

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly, an open source P2P-based file distribution and image acceleration system, is susceptible to a Man-in-the-Middle attack. The scheduler for downloading small files was configured to use th...

PT-2025-38260

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly2 uses the os.MkdirAll function to create directory paths with specific access permissions. This function does not perform permission checks if a directory path already exists, allowing a...

Dragonfly 信任管理问题漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A trust management issue vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from disabling TLS certificate validation, which could lead to man-in-the-middle attacks and...

PT-2025-38258

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly, an open source P2P-based file distribution and image acceleration system, disables TLS certificate verification in its HTTP clients. These clients are not configurable, preventing users...

OPENSUSE-SU-2025:15556-1 tkimg-2.1.0-1.1 on GA media

These are all security issues fixed in the tkimg-2.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

MaxKB 代码问题漏洞

MaxKB is 1Panel-dev open source an open source knowledge base question and answer system based on large language model and RAG. A code issue vulnerability exists in MaxKB version 2.0.2 and earlier and version 2.1.0, which stems from the incorrect manipulation of the parameter code in the file...

BIT-NIFI-2024-56512 Apache NiFi: Missing Complete Authorization for Parameter and Service References

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

CVE-2025-8570 BeyondCart Connector <= 2.1.0 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter

The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determinecurrentuser filter in versions 1.4.2 through 2.1.0. This makes it possible for unauthenticated attackers to craft valid tokens and assume...

CVE-2025-8570

The BeyondCart Connector plugin for WordPress (versions 1.4.2 through 2.1.0) is affected by Privilege Escalation due to improper JWT secret management and authorization in the determine_current_user filter. This allows unauthenticated attackers to craft valid JWTs and impersonate any user (includ...

Linux Distros Unpatched Vulnerability : CVE-2018-14446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MP4Integer32Property::Read in atomavcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash ...

WordPress Tantra Theme <= 2.1.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Tantra versions = 2.1.0...

CVE-2025-58359

Summary: The frost-core (ZF FROST) vulnerability CVE-2025-58359 affects frost-core versions 2.0.0–2.1.0. The issue arises because the refresh shares mechanism in frost_core::keys::refresh did not clearly communicate that changing min_signers would not reduce the threshold, and after refreshing wi...

Linux Distros Unpatched Vulnerability : CVE-2018-17236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The function MP4Free in mp4property.cpp in libmp4v2 2.1.0 internally calls free on a invalid pointer, raising a SIGABRT signal. CVE-2018-17236 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2025-3506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and Checkmk 2.4.0b6 allows attacker to...

Linux Distros Unpatched Vulnerability : CVE-2022-1795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. CVE-2022-1795 Note that Nessus relies on the presence of the package as reported by the vendo...

Linux Distros Unpatched Vulnerability : CVE-2022-3222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV. CVE-2022-3222 Note that Nessus relies on the presence of the package as reported by th...