33898 matches found
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as null route "0" that is being incorrectly...
Server-side Request Forgery (SSRF)
Overview ip is a Node library. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as null route "0" that is bei...
PT-2025-37983
Name of the Vulnerable Software and Affected Versions oa system oasys version 1.1 Description A SQL injection vulnerability exists in oa system oasys version 1.1. This allows a remote attacker to execute arbitrary code via the alph parameters in...
CVE-2025-59437
The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...
Mozilla Firefox Focus for iOS 安全漏洞
Mozilla Focus is a browser for iOS devices from the Mozilla Foundation. Mozilla Focus for iOS suffers from a spoofing vulnerability that is caused by an error in the address bar component. An attacker can exploit the vulnerability to conduct spoofing attacks...
D-Link DIR-823x Command Injection Vulnerability
The D-Link DIR-823X is a wireless router from China's AUO D-Link. A command injection vulnerability exists in the D-Link DIR-823x 250416 and prior versions, which stems from the failure to properly filter constructed command special characters, commands, etc. in the parameter targetaddr in the fi...
CVE-2025-59436
The CVE-2025-59436 entry concerns the npm package ip (node-ip) up to version 2.0.1, where an SSRF vulnerability can be triggered because the IP value 017700000001 is misclassified as globally routable by isPublic. This follows an incomplete fix for CVE-2024-29415. The base score is 3.2 (LOW) with...
PT-2025-38066
Name of the Vulnerable Software and Affected Versions: Signify Wiz Connected version 1.9.1 Description: An incorrect API allows attackers to remotely launch a Denial of Service DoS on Wiz devices. Exploitation requires only the MAC address of the target device. Recommendations: At the moment, the...
PT-2025-37863
Name of the Vulnerable Software and Affected Versions ip aka node-ip versions through 2.0.1 Description The ip aka node-ip package may allow Server-Side Request Forgery SSRF due to the improper categorization of the IP address value 017700000001 as globally routable via the isPublic function. Thi...
CVE-2025-59437
The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...
Linux Distros Unpatched Vulnerability : CVE-2023-53189
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconfmodrstimer, reference idev depends on whether rstimer is not pending. Then modify...
Security Vulnerabilities fixed in Focus for iOS 143.0 — Mozilla
Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press...
BMC Control-M 安全漏洞
BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M that originates when an email address in a client certificate stops validating when it encounters a NULL byte, whi...
CVE-2025-56562
CVE-2025-56562 affects Signify Wiz Connected v1.9.1. The issue is an incorrect API that enables remote denial of service on Wiz devices with only the MAC address, per multiple sources (NVD, Red Hat, CVE listing). The CVSS 3.1 vector indicates Network attack, low complexity, no privileges, with Av...
Unmark Code Issues Vulnerabilities
Unmark is an open source to-do list application for bookmarking. A code issue vulnerability exists in Unmark 1.9.3 and earlier versions, which stems from incorrect manipulation of the parameter url in the file /application/controllers/Marks.php, which could lead to server-side request forgery. An...
CVE-2025-59437
The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...
oasys 安全漏洞
oasys is an OA office automation system by the individual developer misstt123. A security vulnerability exists in oasys version 1.1, which stems from a misuse of the parameter aleph in the file src/main/Java/cn/gson/oasys/controller/address/AddrController, which could lead to an SQL injection...
Wavlink WL-WN578W2 sub_404DBC Function OS Command Injection Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. The Wavlink WL-WN578W2 221110 version has an operating system command injection vulnerability, which originates from the parameter macAddr in the sub404DBC function of the file /cgi-bin/wireless.cgi that fails to correctly filter...