6816 matches found
Kirby vulnerable to path traversal of collection names during file system lookup
TL;DR This vulnerability affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data. Sites that only use fixed calls to the collection helper/$kirby-collection method i.e. calls...
GHSA-X275-H9J4-7P4H Kirby vulnerable to path traversal of collection names during file system lookup
TL;DR This vulnerability affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data. Sites that only use fixed calls to the collection helper/$kirby-collection method i.e. calls...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to the improper handling of dynamic collection names in the collection helper or $kirby-collection method. An attacker can execute arbitrary PHP code and access sensitive files on the server by manipulating the...
CVE-2025-31493
Kirby CVE-2025-31493 affects versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 where dynamic collection names passed to collection() or $kirby->collection() can bypass validation, enabling path traversal. The missing check allowed traversal outside the configured collections root (and even Kirby ...
CVE-2025-31493 Path traversal of collection names during file system lookup
Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data...
CVE-2025-31493
Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the "collection" helper or "$kirby-collection" method with a dynamic collection name such as a collection name that depends on request or user data...
kernel: net: bridge: mcast: wait for previous gc cycles when removing port
A possible use-after-free was found in the Linux kernel in net/bridge/brmulticast.c...
CVE-2025-31493: Improper Limitation of a Pathname to a Restricted Directory
Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data...
PT-2025-20919
Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.9.8.3 Kirby versions prior to 3.10.1.2 Kirby versions prior to 4.7.1 Description: A vulnerability in Kirby affects sites that use the collection helper or $kirby-collection method with a dynamic collection name,...
Browser Security Posture Analysis: a Client-Side Security Assessment Framework
Modern web browsers have effectively become the new operating system for business applications, yet their security posture is often under-scrutinized. This paper presents a novel, comprehensive Browser Security Posture Analysis Framework1, a browser-based client-side security assessment toolkit...
IBM Jazz Reporting Service Code Issue Vulnerability
IBM Jazz Reporting Service is a suite of ready-to-use reporting components from International Business Machines IBM. The product includes features such as report generation, data collection and lifecycle queries. A code issue vulnerability exists in IBM Jazz Reporting Service that stems from a...
CVE
It is an offensive tool for Linux. This repository appears to be...
ByeDPIAndroid - App To Bypass Censorship On Android
Android application that runs a local VPN service to bypass DPI Deep Packet Inspection and censorship. This application runs a SOCKS5 proxy ByeDPI and redirects all traffic through it. Installation Or use Obtainium 1. Install Obtainium 2. Add the app by URL:...
Azure deployed machines fail to Power On due to Data Collection Rule Associations
When applying a Machine Profile to an Azure-based Machine Creation Services catalog, attempting to Start machines may result in one of the following errors: "code":"UnsupportedFeature","message":"Data Collection Rule Associations is not supported in the location of the targeted parent resource...
Enabling Core Dump Collection with ABRT on RHEL/CentOS
This KB outlines the steps to enable core dump collection for Linux VDA modulesctxgfx etc using the ABRT Automatic Bug Reporting Tool framework on RHEL/CentOS systems...
Koillection Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the collection, Wishlist, and album components. An attacker can escalate privileges by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...
ansible-collection-microsoft-sql bug fix and enhancement update
An update is available for ansible-collection-microsoft-sql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release,...
CVE-2025-29746: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components...