Microsoft AutoUpdate for Mac 安全漏洞

Microsoft AutoUpdate for Mac is a Microsoft product auto-update application for the Mac platform from Microsoft Corporation USA. A security vulnerability exists in Microsoft AutoUpdate for Mac. An attacker can exploit the vulnerability to elevate privileges...

Google Android elevation of privilege vulnerability (CNVD-2025-11432)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which arises from the program incorrectly retaining setup privileges, and can be exploited by an attacker to elevate privileges without requiring addition...

Google Chrome < 135.0.7049.41 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 135.0.7049.41. It is, therefore, affected by multiple vulnerabilities as referenced in the 202504stable-channel-update-for-desktop advisory. - Inappropriate implementation in Downloads in Google Chrome prior to...

CVE-2025-3026 Improper Neutralization of Special Elements vulnerability in EJBCA

The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his...

The vulnerability of the sql_tree_hash_1 component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the sqltreehash1 component in the Virtuoso-opensource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially...

The vulnerability in the kernel/workqueue.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the kernel/workqueue.c module in the Linux operating system is related to insufficient resource locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-45361 Mi Connect Service APP protocol flaws lead to leaking sensitive user information

A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information...

The vulnerability of the f2fs component of the Linux operating system’s kernel, which allows a hacker to cause a service failure

The vulnerability of the f2fs component of the Linux operating system’s kernel is related to improper blocking in the function. Exploiting this vulnerability can allow an attacker to cause a service failure...

ChuanhuChatGPT Denial of Service Vulnerability (CNVD-2025-06188)

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a denial of service vulnerability that stems from the use of an insecure regular expression. An attacker can...

The vulnerability of the ext4_xattr_block_cache_find() function in the ext4 component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ext4xattrblockcachefind function in the ext4 component of the Linux operating system is related to a memory overflow issue. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the secretmem component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the secretmem component in the Linux operating system’s kernel is related to memory corruption. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the kernel component of the Linux operating system, which allows a hacker to cause a service failure

The vulnerability of the kernel component of the Linux operating system is related to the state of data race conditions. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the mptcp component in Linux kernel, which allows a hacker to cause a service failure

The vulnerability of the mptcp component in Linux operating systems is related to zero-division errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-10948

A vulnerability in the upload function of binary-husky/gptacademic allows any user to read arbitrary files on the system, including sensitive files such as config.py. This issue affects the latest version of the product. An attacker can exploit this vulnerability by intercepting the websocket...

GHSA-C7FQ-P62P-WVPC Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...

FastChat Denial of Service vulnerability

A Denial of Service DoS vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large...

GHSA-3248-F932-C76P DB-GPT vulnerable to Cross-Site Request Forgery

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...

CVE-2024-7779

CVE-2024-7779 affects the danswer-ai/danswer project, version 1, where an attacker can trigger a Regular Expression Denial of Service (ReDoS) by manipulating regular expressions. The vulnerability can significantly slow response times and potentially render the application unusable. The provided ...

CVE-2024-11441

CVE-2024-11441 affects Serge (open source web interface for chatting via llama.cpp) at version 0.9.0. The issue is a stored XSS caused by improper neutralization of input during web page generation in the chat prompt. An attacker can send a crafted message containing malicious HTML/JavaScript, wh...

Microsoft Dataverse 代码问题漏洞

Microsoft Dataverse is a cloud-based data platform from Microsoft Corporation USA. It is used to share, save, cite, explore and analyze research data. Microsoft Dataverse has a code issue vulnerability that stems from an attacker's ability to remotely execute code by exploiting the vulnerability...