CVE-2025-55055

CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

The vulnerability of the ZenCount visitor counter lies in the lack of measures to neutralize special elements, allowing a violator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ZenCount visitor counter is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Secure PDF eXchange (SPX) function of the Sophos Firewall (formerly known as Sophos XG Firewall) allows a hacker to execute arbitrary code.

The vulnerability of the Secure PDF eXchange SPX function of the Sophos Firewall previously called Sophos XG Firewall exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability can allow a remote attacker t...

The vulnerability of the TrueConf Server software, related to the failure to take measures to neutralize special elements, allows a perpetrator to execute arbitrary commands and cause service failures.

The vulnerability of the TrueConf Server software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and cause service failures...

CLSA-2025-1763031933 libxml2: Fix of 3 CVEs

CVE-2025-9714: additional fixes - CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c - CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990916)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990916 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't skip expired elements during walk There is an asymmetry between...

Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2017-17512)

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. This plugin...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to gain unauthorized access to protected information.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge browsers allows attackers to access confidential information.

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers allows attackers to circumvent existing security restrictions.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...

kernel: RDMA/rxe: Fix the qp flush warnings in req

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the qp flush warnings in req When the qp is in error state, the status of WQEs in the queue should be set to error. Or else the following will appear. 920.617269 WARNING: CPU: 1 PID: 21 at...

kernel: usbnet: ipheth: use static NDP16 location in URB

In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowed for the start of NDP16 to be anywhere within the URB based on the wNdpIndex value in NTH16. Only the start position of NDP16 was checked, so it was possible f...

The vulnerability of the Pandoc format conversion library written in Haskell lies in its susceptibility to manipulation at the server-side level, allowing attackers to disclose confidential information.

The vulnerability of the Pandoc format conversion library written in the Haskell programming language is related to the manipulation of requests on the server side. Exploiting this vulnerability allows a malicious actor to disclose protected information using elements...

The vulnerability of the Apache Tomcat application server arises from the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-64347

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

CVE-2025-63714

Cross-Site Scripting XSS vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of...

CVE-2025-64347

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

CVE-2025-64347 Apollo Router Improperly Enforces Renamed Access Control Directives

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

CVE-2025-64347 Apollo Router Improperly Enforces Renamed Access Control Directives

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

CVE-2025-64347

CVE-2025-64347 concerns Apollo Router Core. Affected: Router Core with Apollo Federation 2, specifically versions 1.61.12-rc.0 and below, and 2.8.1-rc.0 and below. Root cause: access control directives renamed via @link imports were not enforced on renamed schema elements (e.g., fields and types)...