649 matches found
CVE-2025-11222
Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft...
Directory Traversal
Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Directory Traversal via the reply.from function. An attacker can access unauthorized routes by crafting a malicious URL containing encoded directory...
PT-2025-48579
Name of the Vulnerable Software and Affected Versions fastify-reply-from versions prior to 12.5.0 Description fastify-reply-from is a Fastify plugin used to forward HTTP requests to another server. Versions of the plugin prior to 12.5.0 contain a flaw where a malicious URL can be crafted to allow...
CVE-2025-36357
IBM Planning Analytics Local (Workspace) versions 2.1.0–2.1.14 are affected by a directory traversal vulnerability that allows a remote authenticated user to view, read, or write arbitrary files by sending crafted URLs containing absolute path sequences. The issue is caused by improper handling o...
EUVD-2025-37410
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers ...
Missing Authorization
Overview com.liferay:com.liferay.blogs.item.selector.web is a Liferay Blogs Item Selector Web Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the BlogsItemSelectorViewDisplayContext class, when handling image access. An attacker can...
Liferay Portal and DXP do not check permissions of images in a blog entry
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers ...
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console...
koa 输入验证错误漏洞
koa is a Koa.js open source expressive middleware using node.js. An input validation error vulnerability exists in koa version 2.16.2 up to and including version 2.16.3 and version 3.0.1 up to and including version 3.0.3, which stems from incorrect handling of specially crafted URLs and can lead ...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the comliferaychangetrackingwebportletPublicationsPortletvalue parameter. An attacker can access and modify publication comments by sending crafted URLs as an authenticated user. Remediation Upgrade...
EUVD-2008-6498
Malware in sbrugna...
EUVD-2010-1266
Malware in sbrugna...
EUVD-2020-3091
Malware in sbrugna...
EUVD-2018-17290
Malware in sbrugna...
EUVD-2018-18588
Malware in sbrugna...
EUVD-2019-15593
Malware in sbrugna...
EUVD-2020-12201
Malware in sbrugna...
EUVD-2014-8585
Malware in sbrugna...