10504 matches found
U.S. Dept Of Defense: SQL Injection - data[account][id] parameter
A SQL injection vulnerability was discovered in the "dataaccountid" parameter on the website. The vulnerability allowed for the manipulation of SQL queries executed by the backend database. The impact of this vulnerability was not specified...
Security update for libva
This update for libva fixes the following issues: Update to libva version 2.20.0, which includes security fix for: CVE-2023-39929: Uncontrolled search path may allow an authenticated user to escalate privilege via local access bsc1224413, jscPED-11066 This includes latest version of one of the...
DataEase 安全漏洞
DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insights into business trends for business improvement and optimization. A security vulnerability exists in versions prior to DataEase 2.10.9 , which...
SUSE CVE-2017-13670
In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...
SUSE CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries...
Information Disclosure
@backstage/plugin-permission-backend is vulnerable to information disclosure. The vulnerability is due to improper handling of conditional decisions in the permission backend, allowing callers to infer sensitive information...
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
Impact It is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Preven...
GHSA-F69V-XRJ8-RHXF org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
Impact It is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Preven...
Out of bounds read in parse_module function in bfd/vms-alpha.c
...
DataEase 安全漏洞
DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. A security vulnerability exists in DataEase versions prior to 2.10.8 that...
cve
Vulnerability Title: Arbitrary File Read in QCMS Authenticate...
[SECURITY] Fedora 41 Update: perl-PAR-Packer-1.063-5.fc41
This module implements the App::Packer::Backend interface, for generating stand-alone executables, perl scripts and PAR files...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the verifyconnection function, by manipulating the backend requests to arbitrary systems. Remediation Upgrade open-webui to version 0.6.34 or higher. References - GitH...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the middleware chain to access backend services by including traversal sequences like /../ in a request. Detai...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the middleware chain to access backend services by including traversal sequences like /../ in a request. Detai...
Directory Traversal
Overview github.com/traefik/traefik/v2/pkg/server is a server package for traefik, a cloud native edge router. Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the middleware chain to access backend services by including traversal sequences like /../ in a request. Detai...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the middleware chain to access backend services by including traversal sequences like /../ in a request. Detai...
CVE-2025-32431
CVE-2025-32431 : Traefik is vulnerable when using path-based matchers (PathPrefix, Path, PathRegex). If a request URL contains a trailing path traversal like /../ in the path, an attacker can bypass middleware routing and target a backend exposed via another router. This affects older releases pr...
