CVE-2026-23904

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

CVE-2026-23904

creationtimestamp| type| source ---|---|--- 2026-07-29 07:32:53+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrrfvdl5p62d 2026-07-29 10:42:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrrqjajyro2b...

CVE-2022-23904

Rainworx Auctionworx 3.1R2 is vulnerable to a Cross-Site Request Forgery CSRF attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition...

CVE-2025-23904

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through = 1.0...

Linux Distros Unpatched Vulnerability : CVE-2020-23904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service DoS via a crafted WAV file. NOTE: the vendor states I cannot...

CVE-2025-23904

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through = 1.0...

CVE-2025-23904 WordPress Rebrand Fluent Forms Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through = 1.0...

CVE-2025-23904

CVE-2025-23904 concerns the WordPress/Rebrand Fluent Forms plugin (versions

K000148895: Intel UEFI firmware vulnerabilities CVE-2023-2235, CVE-2023-23904, and CVE-2023-25546

Security Advisory Description CVE-2023-22351 Out-of-bounds write in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-23904 NULL pointer dereference in the UEFI firmware for some IntelR Processors may allo...

CVE-2024-23904

creationtimestamp| type| source ---|---|--- 2024-01-24 19:27:10+00:00| seen| https://t.me/ctinow/173037 2024-01-28 12:25:22+00:00| seen| https://t.me/arpsyndicate/3288 2024-02-18 10:48:44+00:00| seen| https://t.me/ctinow/187205 2025-06-20 19:43:36+00:00| seen|...

CVE-2024-23904

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file syst...

CVE-2024-23904

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file syst...

CVE-2024-23904

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file syst...

CVE-2024-23904

Jenkins Log Command Plugin version 1.0.2 and earlier is vulnerable. The issue stems from a command parser feature that replaces an '@' character followed by a file path in an argument with the file’s contents, enabling unauthenticated attackers to read arbitrary files on the Jenkins controller fi...

CVE-2022-23904

creationtimestamp| type| source ---|---|--- 2022-08-16 22:01:19+00:00| seen| https://t.me/cibsecurity/41718...

CVE-2022-23904

The CVE-2022-23904 entry describes a CSRF vulnerability in Rainworx Auctionworx prior to 3.1R2. Affected product version(s) allow an authenticated user to upgrade their own account to admin, enabling access to the Auctionworx admin control panel (Enterprise and Events Edition). Root cause is CSRF...

CVE-2020-23904

A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service DoS via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program...

CVE-2020-23904

A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service DoS via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program...

CVE-2020-23904

CVE-2020-23904 affects Speex v1.2, with a stack-based buffer overflow in speexenc.c triggered by a crafted WAV file. The vulnerability can lead to a denial of service. The vendor notes inability to reproduce it and describes Speex as a demo program, which implies limited or unverified exploit pra...