CVE-2025-55202 Opencast has a partial path traversal vulnerability in UI config

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases...

GHSA-HQ8M-V68G-8CF8 Opencast has a partial path traversal vulnerability in UI config

The protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the...

Opencast has a partial path traversal vulnerability in UI config

The protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the...

CVE-2025-9646

CVE-2025-9646 affects O2OA up to version 10.0-410. The vulnerability is a cross-site scripting flaw in the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig, caused by manipulation of the toMonthViewName parameter. It is exploitable remotely and, per sources, the exploit has ...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA 10.0-410 and earlier versions, which originates from cross-site scripting due to incorrect operation of the parameter toMonthViewName in the file...

github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

Summary It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA head...

CLSA-2025-1756408700 nodejs: Fix of CVE-2024-25629

CVE-2024-25629: prevent reading before buffer start when parsing config files containing an embedded NULL as the first character of a line by discarding such lines in aresreadline...

CVE-2024-13986

Nagios XI 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename...

CVE-2024-13986

Nagios XI 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename...

CVE-2024-13986 Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Nagios XI 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename...

CVE-2024-13986

CVE-2024-13986 affects Nagios XI versions prior to 2024R1.3.2. It enables remote code execution by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface, due to insufficient validation of file paths and extensions during MIB upload and snapshot r...

NeuVector process with sensitive arguments lead to leakage

Impact When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example, java -cp /app ... Djavax.net.ssl.trustStorePassword= The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the...

MAL-2025-41574 Malicious code in int-lib-config (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41490 Malicious code in @twork-data-services/currency-config (npm)

--- -= Per source details. Do not edit below this line.=-...

Google Android Information Disclosure Vulnerability (CNVD-2025-19923)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that is caused by an error in hiddconn.cc's hiddcheckconfigdone. An attacker can exploit the vulnerability to obtain sensitive information...

PT-2025-35120

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.2.11 Description Paymenter is a free and open-source webshop solution for hostings. The ticket attachments functionality allows a malicious authenticated user to upload arbitrary files. This could result in...

ZrLog 安全漏洞

ZrLog is a blogging system developed in Java language by xiaochun individual developer. A security vulnerability exists in ZrLog 3.1.5 and earlier versions, which stems from cross-site scripting due to incorrect manipulation of the parameter footerLink in the file /api/admin/template/config...

PT-2025-35099

Name of the Vulnerable Software and Affected Versions: Nagios XI versions prior to 2024R1.3.2 Description: Nagios XI is susceptible to remote code execution due to chained flaws: an arbitrary file upload and a path traversal within the Core Config Snapshots interface. Insufficient validation of...

COMFAST CF-N1 安全漏洞

COMFAST CF-N1 is a wireless router from China Four Seas Zonglian COMFAST. A security vulnerability exists in COMFAST CF-N1 version 2.6.0, which originates from a command injection due to incorrect operation of the parameter pingconfig in the file /usr/bin/webmgnt...

PT-2025-35135

Name of the Vulnerable Software and Affected Versions: Comfast CF-N1 version 2.6.0 Description: A vulnerability exists in the ping config function of the /usr/bin/webmgnt file, which can lead to command injection. Remote exploitation is possible. The exploit has been publicly disclosed...