UI for Apache Kafka 安全漏洞

UI for Apache Kafka is an open source front-end interface for Kafka by Provectus. A security vulnerability exists in UI for Apache Kafka versions v0.6.0 through v0.7.2, which originates from the upload of a specially crafted configuration file and could lead to a denial of service attack...

EUVD-2019-5640

Malware in sbrugna...

EUVD-2019-9494

Malware in sbrugna...

EUVD-2020-23825

Malware in sbrugna...

EUVD-2025-5950

Malicious code in bioql PyPI...

EUVD-2025-22072

Malicious code in bioql PyPI...

CVE-2025-56816

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load or loadAs method without input...

Linux Distros Unpatched Vulnerability : CVE-2025-50151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. User...

Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

DEBIAN-CVE-2025-50151

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

UBUNTU-CVE-2025-50151

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-50151

CVE-2025-50151 affects Apache Jena up to version 5.4.0, where file access paths in configuration files uploaded by administrators are not validated. The issue’s root cause is the missing validation of configuration file paths, allowing potential arbitrary file access. Mitigation: upgrade to Apach...

CVE-2025-3626

CVE-2025-3626 describes an OS Command Injection vulnerability in Frauscher Sensortechnik products (Frauscher FDS101/FDS102 and related FDS00x series) triggered when uploading configuration files via a webUI. The root cause is improper neutralization of special elements in OS commands during confi...

CVE-2025-41651

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise...

CVE-2019-19902

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to...

CVE-2019-8114

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload...

CVE-2024-41339

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigo...

CVE-2024-41339

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigo...

CVE-2024-41339

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigo...

PT-2024-10082 · Zyxel · Zyxel Wbe530 +1

Name of the Vulnerable Software and Affected Versions: Zyxel WBE530 firmware versions through 7.00ACLE.3 Zyxel WBE660S firmware versions through 6.70ACGG.2 Description: An improper privilege management vulnerability in the web management interface could allow an authenticated user with limited...