koa 输入验证错误漏洞

Koa.js is an open-source project developed by Koa.js, which uses Node.js as an expressive middleware. Versions of Koa prior to 3.1.2 and 2.16.4 contained a vulnerability related to input validation errors. This vulnerability stemmed from improper parsing of the HTTP Host header, which could lead ...

dottie 安全漏洞

Dottie is an application developed by Mick Hansen that allows for easy searching of nested keys. Versions 2.0.4 to 2.0.6 of Dottie contain security vulnerabilities, which stem from incomplete prototype pollution protection mechanisms. These vulnerabilities could lead to bypassing the protection...

Parse Dashboard 安全漏洞

Parse Dashboard is an dashboard tool open source by the Parse Platform. Versions of Parse Dashboard from 7.3.0-alpha.42 to 9.0.0-alpha.7 have security vulnerabilities. These vulnerabilities stem from ConfigKeyCache using the same cache keys for both master keys and read-only master keys, which ma...

SAP S/4HANA 安全漏洞

SAP S/4HANA is a enterprise resource management software developed by SAP, a German company, based on the SAP HANA memory database system. There is a security vulnerability in SAP S/4HANA. Under certain conditions, authenticated attackers can access restricted information, which may have a minor...

Fiber 安全漏洞

Fiber is an open-source web framework written in Go language. Versions of Fiber prior to 3.1.0 have a security vulnerability. This vulnerability stems from the fiberflash cookie, which can trigger excessive memory allocation through unvalidated msgpack deserialization, potentially leading to...

Calibre 路径遍历漏洞

Calibre is an open-source, free tool developed by Kovid Goyal, a personal developer from India. It serves as a comprehensive e-book reading management and format conversion tool. Calibre versions 9.2.1 and earlier had a path traversal vulnerability. This vulnerability stemmed from a flaw in the...

SillyTavern 代码问题漏洞

SillyTavern is a frontend interface for the SillyTavern open-source language model. Versions of SillyTavern prior to 1.16.0 had code vulnerabilities. These vulnerabilities stemmed from server-side request forgeing in the asset download endpoint, which could allow authenticated users to make...

GFI MailEssentials AI 安全漏洞

GFI MailEssentials AI is an open-source anti-spam and data breach protection software developed by GFI in the United States. Versions of GFI MailEssentials AI prior to version 22.4 contained a security vulnerability. This vulnerability stemmed from a storage cross-site scripting vulnerability...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from hypercalls disrupting the register state, potentially leading to page faults...

Jenkins 安全漏洞

Jenkins is an open-source application developed by Jenkins Project. The open-source automation server Jenkins offers hundreds of plugins to support building, deploying, and automating any project. Vulnerabilities existed in Jenkins versions 2.483 to 2.550, as well as in LTS versions 2.492.1 to...

Blossom 路径遍历漏洞

Blossom is a project management platform developed by Blossom Inc. Versions of Blossom prior to 1.17.1 contained a path traversal vulnerability. This vulnerability stemmed from improper path handling in the file upload component, which could lead to path traversal attacks...

IBM DataStage on Cloud Pak for Data 代码问题漏洞

IBM DataStage on Cloud Pak for Data is an enterprise-level data integration solution provided by IBM Corporation. There is a code vulnerability in IBM DataStage on Cloud Pak for Data, which stems from unlimited file uploads. This vulnerability could allow authenticated users to execute arbitrary...

Intelbras VIP 3260 Z IA 授权问题漏洞

The Intelbras VIP 3260 Z IA is an IP surveillance camera produced by the Brazilian company Intelbras. Version 2.840.00IB005.0.T of the Intelbras VIP 3260 Z IA has an authorization issue vulnerability. This vulnerability stems from incorrect handling of files/OutsideCmd, which may lead to the...

Micca KE700 安全漏洞

The Micca KE700 is a source bookshelf speaker produced by the Micca company. The Micca KE700 has a security vulnerability. This vulnerability arises from the fact that authentication is performed using only 6-bit identifiers in the rolling code. The low entropy value in this code can lead to...

free5GC 安全漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Version 4.0.1 of free5GC contains a security vulnerability, which stems from improper input validation and protocol compliance. This vulnerability could allow remote attackers to cause denial-of-service attacks...

grub-btrfs 操作系统命令注入漏洞

Grub-Btrfs is a Linux tool developed by Antynea’s individual developers. Versions of Grub-Btrfs starting from 2026-01-31 and earlier contained an operating system command injection vulnerability. This vulnerability stemmed from the lack of cleanup of the $root parameter, which could lead to OS...

thesystem SQL注入漏洞

thesystem is a password management project developed by Kostas Mitroglou. Version 1.0 of thesystem has a SQL injection vulnerability, which stems from improper handling of the username parameter, potentially leading to SQL injection attacks...

PostgreSQL 安全漏洞

PostgreSQL is a set of free object-relational database management systems developed by the PostgreSQL organization. This system supports most SQL standards and offers many other features, such as foreign keys, triggers, views, etc. Vulnerabilities existed in versions prior to PostgreSQL 18.2, 17....

PJSIP 安全漏洞

PJSIP is an open-source, free and open-source multimedia communication library developed in C language. It implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. PJSIP versions 2.16 and earlier contained security vulnerabilities, which stemmed from buffer overflows when...

Medusa 安全漏洞

Medusa is an open-source video library manager for TV shows developed by pyMedusa. Versions of Medusa prior to 2.12.2 contained security vulnerabilities. These vulnerabilities stemmed from a race condition in the registerUsage function of the promotional module, which could allow unauthenticated...