60717 matches found
Parse Server 安全漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 9.6.0-alpha.17 and 8.6.42. These vulnerabilities stemmed from the ability to override fields...
Mura 安全漏洞
Mura is a content management system developed by Mura Corporation. Versions of Mura 10.1.10 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the bundled package creation feature lacking CSRF token validation, which could lead to data leakage...
PT-2026-26081
MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality csettings.cfc createBundle method that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerabili...
CVE-2026-33042: Improper Authentication
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty authData object, bypassing the username and password requirement. This allows the creati...
The vulnerability of the il4965_setup_deferred_work() function in the drivers/net/wireless/intel/iwlegacy/4965-mac.c driver of the Intel wireless communication adapter driver for the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the il4965setupdeferredwork function in the drivers/net/wireless/intel/iwlegacy/4965-mac.c driver for Intel wireless communication drivers in the Linux operating system is related to the assignment of pointers due to the lack of checking the return value of the...
Link following vulnerability allows arbitrary file creation
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives. This allows crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...
CVE-2026-1376
creationtimestamp| type| source ---|---|--- 2026-03-17 22:32:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbzntn3nf2n 2026-03-18 01:45:39+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhcehxyjxf2l 2026-03-20 01:40:09+00:00| seen|...
CVE-2026-25770
creationtimestamp| type| source ---|---|--- 2026-03-17 21:02:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbunjfvy62k 2026-03-17 21:02:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbuocmang26 2026-03-19 18:20:09+00:00| seen|...
GHSA-2F9H-23F7-8GCX AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...
CVE-2026-4295
creationtimestamp| type| source ---|---|--- 2026-03-17 19:16:14+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4295 2026-03-17 20:48:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbtuq4djs2c 2026-04-30 12:30:32+00:00| seen|...
CVE-2025-64301
creationtimestamp| type| source ---|---|--- 2026-03-17 19:00:34+00:00| seen| https://infosec.place/objects/565ff8cd-4460-435b-ac33-92828813ed8a 2026-03-17 19:31:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbpknypna2v 2026-03-19 13:40:09+00:00| seen|...
CVE-2025-66000
creationtimestamp| type| source ---|---|--- 2026-03-17 19:00:28+00:00| seen| https://infosec.place/objects/e0a1d36d-36de-4e6e-9304-160cc8ea3115...
CVE-2025-62500
creationtimestamp| type| source ---|---|--- 2026-03-17 19:00:11+00:00| seen| https://infosec.place/objects/4f3190b0-b252-4462-908e-c8ab9a64a8a6...
GHSA-5V7G-9H8F-8PGG Parse Server session creation endpoint allows overwriting server-generated session fields
Impact An authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST /classes/Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows...
Parse Server session creation endpoint allows overwriting server-generated session fields
Impact An authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST /classes/Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows...
CVE-2026-30953
creationtimestamp| type| source ---|---|--- 2026-03-17 17:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhbjdsyb322e...
CVE-2026-28519
creationtimestamp| type| source ---|---|--- 2026-03-17 17:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhbh4h2rtx2u 2026-08-19 09:34:03+00:00| seen| https://bsky.app/profile/secqube.com/post/3mtgghda2562f...