Astra Linux – Vulnerability in python-urllib3

In urllib3 before version 1.24.2, the authorization HTTP header is not removed when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE:...

CVE-2018-25328

VX Search 10.6.18 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying an oversized string in the directory field. Attackers can craft a malicious input file containing 271 bytes of junk data followed by a return address to execute...

CVE-2018-25330

creationtimestamp| type| source ---|---|--- 2026-05-17 14:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2msvtccr2i...

CVE-2018-25327

creationtimestamp| type| source ---|---|--- 2026-05-17 14:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2mhklkqp2p...

CVE-2018-25325

creationtimestamp| type| source ---|---|--- 2026-05-17 14:37:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2lm36p7j2c...

CVE-2018-25331

creationtimestamp| type| source ---|---|--- 2026-05-17 14:36:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2lj3hrou2o...

CVE-2018-25333

creationtimestamp| type| source ---|---|--- 2026-05-17 14:34:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2lgarnhh2r...

CVE-2018-25333

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloa...

CVE-2018-25326

Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by injecting directory traversal sequences in the filename parameter. Attackers can send POST requests to gdrive-ajaxs.php with the ajaxstype parameter set to...

CVE-2018-25338

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names...

CVE-2018-25335

CVE-2018-25335 affects the WordPress plugin Peugeot Music 1.0. It contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload files via POST to upload.php, with attackers able to set arbitrary file extensions by manipulating the name parameter to execute code f...

CVE-2018-25327

Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete job entries or modi...

CVE-2018-25320 ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to...

CVE-2018-25336

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25336 2026-05-17 15:03:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2mzmqv3j2e...

CLSA-2026-1778881024 quagga: Fix of CVE-2018-5380

CVE-2018-5380: fix BGP NOTIFY debug-print msg array over-read...

CVE-2018-16885

creationtimestamp| type| source ---|---|--- 2026-05-07 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260508...

RHCOS 3 : OpenShift Container Platform 3.10 mediawiki (RHSA-2019:3238)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3238 advisory. - mediawiki: $wgRateLimits rate limit / ping limiter entry for 'user' overrides that for 'newbie' CVE-2018-0503 - mediawiki:...

spamassassin: Fix of CVE-2018-11805

CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates...

CLSA-2026-1777548877 spamassassin: Fix of CVE-2018-11805

CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates...

CLSA-2026-1777884162 Fix CVE(s): CVE-2018-8014

Fix build process: - debian/keystores/ca-cert.pem, ca.jks: regenerate self-signed test CA using the existing ca-key.pem previous CA valid only until 21.03.2025. New validity: 21.04.2026 to 18.04.2036. - debian/keystores/localhost-cert.pem, localhost.jks, localhost-copy1.jks: re-issue against the...