1912 matches found
MAL-2025-18559 Malicious code in doc-smith (npm)
The package doc-smith was found to contain malicious code...
MAL-2025-17474 Malicious code in config-doc (npm)
The package config-doc was found to contain malicious code...
MAL-2025-21874 Malicious code in grapesjs-from-doc (npm)
The package grapesjs-from-doc was found to contain malicious code...
The vulnerability of the Tab-Doc API interface of the Tableau Server analytical platform allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Tab-Doc API interface of the Tableau Server analytical platform relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...
PT-2025-32615 · Sap · Sap Netweaver Application Server Abap
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP BIC Document affected versions not specified Description: SAP NetWeaver Application Server ABAP BIC Document is susceptible to a crafted request that, when submitted to a BIC Document application, can cau...
Malicious code in badger-doc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 102e103c2148dd46b3b7b80cbf9641deea29213407e46ee74af433da247bd9ef The OpenSSF Package Analysis project identified 'badger-doc' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2025-6810 Malicious code in badger-doc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 102e103c2148dd46b3b7b80cbf9641deea29213407e46ee74af433da247bd9ef The OpenSSF Package Analysis project identified 'badger-doc' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the listCount function in the DocStoreDAO interface when the entityType parameter is used to construct a SQL query. An attacker can extract sensitive information from the database by injecting crafted input into the...
The vulnerability in the WeGIA web manager’s script /html/funcionario/dependente_editarDoc.php allows a perpetrator to disclose confidential information, increase their privileges, or execute arbitrary code.
The vulnerability of the /html/funcionario/dependenteeditarDoc.php web manager of WeGIA is related to the failure to protect the SQL query structure when processing the parameter idatendidofamiliares. Exploiting this vulnerability can allow an attacker to disclose confidential information, enhanc...
CVE-2025-52446: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux tab-doc api modules allows Interface Manipulation data access to the production database cluster.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19...
WeGIA SQL Injection Vulnerability (CNVD-2025-17263)
WeGIA is a web manager for welfare organizations. WeGIA suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/funcionario/dependenteeditarDoc.php endpoint idatendidofamiliares parameter. An attacker could exploit...
WeGIA SQL注入漏洞
WeGIA is a web manager for welfare organizations. WeGIA suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/funcionario/dependenteeditarDoc.php endpoint idatendidofamiliares parameter. An attacker could exploit...
OPENSUSE-SU-2025:15270-1 python-furo-doc-2024.8.6-3.1 on GA media
These are all security issues fixed in the python-furo-doc-2024.8.6-3.1 package on the GA media of openSUSE Tumbleweed...
xmlsec:xmlsec_fuzzer: Heap-buffer-overflow in xmlParsePubidLiteral
Project: https://github.com/lsh123/xmlsec.git Detailed Report: https://oss-fuzz.com/testcase?key=5606523386789888 Project: xmlsec Fuzzing Engine: libFuzzer Fuzz Target: xmlsecfuzzer Job Type: libfuzzerasanxmlsec Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...
SQL Injection
Overview llama-index-vector-stores-duckdb is a llama-index vectorstores duckdb integration Affected versions of this package are vulnerable to SQL Injection through the DuckDBVectorStore class. An attacker can manipulate the refdocid parameter, enabling them to read and write arbitrary files on t...
LlamaIndex SQL注入漏洞
LlamaIndex is a data framework for LLM applications from LlamaIndex open source. A SQL injection vulnerability exists in LlamaIndex version v0.12.19, which stems from improper manipulation of the refdocid parameter leading to SQL injection, which could lead to remote code execution...
CVE-2024-32468
Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the denodoc crate which lead to Self-XSS with deno doc --html. 1. XSS in generated searchindex.js, denodoc outputs a JavaScript file for searching. However, the generated file...
CVE-2024-0216
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating...
CVE-2022-1731
Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist...