Linux Distros Unpatched Vulnerability : CVE-2021-22569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small...

Linux Distros Unpatched Vulnerability : CVE-2017-18635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages...

Visitor Management System query_data.php File SQL Injection Vulnerability

Visitor Management System is a visitor access management system. Visitor Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter dateF/dateP in the file /querydata.php. An attacker can exploit...

Linux Distros Unpatched Vulnerability : CVE-2020-26088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets,...

WordPress plugin BuddyPress XProfile Custom Image Field 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2025-33917 · Unknown · Buddypress Xprofile Custom Image Field

Name of the Vulnerable Software and Affected Versions: BuddyPress XProfile Custom Image Field versions through 3.0.1 Description: This issue involves an improper limitation of a pathname to a restricted directory, also known as a path traversal. This allows an attacker to access restricted...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the getLanguage and getClassTypeFields functions used by the Asset Publisher configuration UI. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious inp...

Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the getLanguage and getClassTypeFields functions used by the Asset Publisher configuration UI. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious inp...

CVE-2025-43744

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

CVE-2025-38613

In the Linux kernel, the following vulnerability has been resolved: staging: gpib: fix unset padding field copy back to userspace The introduction of a padding field in the gpibboardinfoioctl is showing up as initialized data on the stack frame being copyied back to userspace in function...

DEBIAN-CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

UBUNTU-CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-38557 HID: apple: validate feature-report field count to prevent NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-38557

CVE-2025-38557 : In the Linux kernel HID subsystem, a vulnerability affects the apple_backlight feature. A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference when toggling the power feature-report if the HID descriptor declares only one field for the powe...

CVE-2025-38557 HID: apple: validate feature-report field count to prevent NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-38556

In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should...

CVE-2025-51488

MoonShine, a Laravel-based admin panel, is affected by CVE-2025-51488 due to a Stored XSS in the Create Admin flow. The vulnerability arises from improper sanitization of the Name parameter when creating a new Admin, allowing an attacker to store and execute arbitrary JavaScript in victims’ brows...