Linux Distros Unpatched Vulnerability : CVE-2017-2668

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote...

CVE-2025-7821

The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswclogofaviconlogobase' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo...

CVE-2025-7821 WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation

The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswclogofaviconlogobase' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo...

CVE-2025-7821 WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation

The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswclogofaviconlogobase' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo...

CVE-2025-7821

CVE-2025-7821 affects the WC Plus WordPress plugin (versions up to and including 1.2.0). The vulnerability arises from a missing capability check on the pluswc_logo_favicon_logo_base AJAX action, allowing unauthenticated modification of the site favicon/logo base. CVSS v3.1 base score is 5.3 (Med...

Bouncy Castle for Java has Out-of-Bounds Write Vulnerability

Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All API modules. This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the JCE Cipher.doFinal function in org/bouncycastle/jcajce/provider/BaseCipher when the same byte array is used for both input and output during native encrypt or decrypt operations. An attacker can cause data...

CVE-2025-9340 native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.

Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All API modules. This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0...

CVE-2025-9340

CVE-2025-9340 is an Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java—BC-FJA 2.1.0 (API modules), affecting the file org/bouncycastle/jcajce/provider/BaseCipher. IBM security bulletins confirm this issue alongside CVE-2025-9341 and tie the impact to BC-F...

CVE-2024-57152

Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class...

Fedora: Security Advisory (FEDORA-2025-9b8165a4b3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-20250822-20

Vulnerability in GPAC multimedia platform, related to manipulation of baseiniturl argument, resulting in the dereferencing of a null pointer. Exploitation of the vulnerability could allow an attacker, acting remotely to cause a denial of service...

Node.js Cipher Base Code Execution

The vulnerability of the Node.js software platform’s cipher-based encryption package is related to deficiencies in the mechanism for verifying input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted JSON file...

SUSE CVE-2025-9287

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4...

CVE-2025-9308

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects...

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2. Mitigation Mitigation for this issue is either not available or the currently available options do not me...

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Summary This affects e.g. create-hash and crypto-browserify, so I'll describe the issue against that package Also affects create-hmac and other packages Node.js createHash works only on strings or instances of Buffer, TypedArray, or DataView. Missing input type checks in npm create-hash polyfill ...

@5ht/express (>=1.0.6, <=2.2.0), @audius/sdk (>=0.0.3-beta.1, <=7.1.1) +7 more potentially affected by CVE-2025-9287 via cipher-base (1.0.4)

cipher-base NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on cipher-base and may be impacted: - @5ht/express =1.0.6, =0.0.3-beta.1, =6.0.4, =1.0.1, =1.5.2-beta.1, =1.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.11 Source cves: CVE-2025-9287...

@5ht/express (>=1.0.6, <=2.2.0), @audius/sdk (>=0.0.3-beta.1, <=7.1.1) +7 more potentially affected by CVE-2025-9287 via cipher-base (1.0.4)

cipher-base NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on cipher-base and may be impacted: - @5ht/express =1.0.6, =0.0.3-beta.1, =6.0.4, =1.0.1, =1.5.2-beta.1, =1.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.11 Source cves: CVE-2025-9287...

CVE-2025-9287

An improper input validation vulnerability was found in the cipher-base npm package. Missing input type checks in the polyfill of the Node.js createHash function result in invalid value calculations, hanging and rewinding the hash state, including turning a tagged hash into an untagged hash, for...