2905 matches found
Malicious Package
Overview setago3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for social...
Cross-site Scripting (XSS)
github.com/usememos/memos is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unrestricted external image embedding because markdown images with arbitrary URLs are automatically fetched when viewing a memo, exposing the user's IP address, browser User-Agent, and other...
CVE-2012-10044
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
CVE-2012-10044 MobileCartly 1.0 savepage.php Arbitrary File Creation
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
K000152924: Apache HTTP Server vulnerability CVE-2024-43204
Security Advisory Description SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a valu...
GHSA-XP75-R577-CVHP Privileged OpenBao Operator May Execute Code on the Underlying Host
Impact Under certain threat models, OpenBao operators with privileged API access may not be system administrators and thus normally lack the ability to update binaries or execute code on the system. Additionally, privileged API operators should be unable to perform TCP connections to arbitrary...
GHSA-8QF3-X8V5-2PJ8 uv allows ZIP payload obfuscation through parsing differentials
Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...
CVE-2025-32430
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...
EDK2 SMM MCE Enablement Issue
Summary A researcher reported a bug in the open source EDK2 system management interrupt SMI entry code when an MCE occurs near the start of the SMI handler. An attacker who can inject a machine check exception MCE could cause execution to jump to an attacker-controlled interrupt handler, leading ...
CVE-2025-32430
CVE-2025-32430 – XWiki Platform Reflected XSS . Affected: XWiki Platform versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5, and 17.0.0-rc-1 through 17.2.2. Issue: two templates contain reflected XSS allowing attacker-controlled URLs to execute JavaScript in the victim’s session...
CVE-2025-54132
CVE-2025-54132 affects Cursor’s Mermaid-based diagram tool prior to version 1.3. An attacker can trigger prompt injections to cause Mermaid-rendered images to fetch data to a remote attacker-controlled server, enabling exfiltration of sensitive information. The issue is fixed in version 1.3; upgr...
CVE-2025-44109
A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...
CVE-2025-50477
A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...
CVE-2025-44109
A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...
CVE-2025-50477
A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...
CVE-2025-44109
CVE-2025-44109 describes a URL redirection vulnerability in Pinokio v3.6.23 that can redirect victim users to attacker-controlled pages. Affected software: Pinokio Desktop (v3.6.23); underlying issue attributed to the URL redirection feature. Impact per CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A...
CVE-2025-50477
A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...
CVE-2025-50477
CVE-2025-50477 describes a URL redirection vulnerability in lbry-desktop version 0.53.9. The issue arises from the URL redirection feature, enabling an attacker to redirect users to attacker-controlled pages. Documented impact is user redirection with low confidentiality and availability impact, ...
