5808 matches found
CVE-2025-6984
CVE-2025-6984 (LangChain EverNoteLoader XXE) : The langchain-ai/langchain package’s EverNoteLoader is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63, where etree.iterparse() is used without disabling external entity processing, enabling...
NVIDIA Cumulus Linux和NVIDIA NVOS 日志信息泄露漏洞
NVIDIA Cumulus Linux is an open network operating system.NVIDIA NVOS is an operating system. A log information disclosure vulnerability exists in NVIDIA Cumulus Linux and NVIDIA NVOS. The vulnerability stems from a hash password that is not properly hidden in log files and can be exploited by an...
CVE-2023-7307
Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...
CVE-2023-7307
CVE-2023-7307 affects Sangfor Behavior Management System (DC Management System). The vulnerability is an XML external entity (XXE) injection in the /src/sangforindex endpoint caused by improper XML parser configuration, allowing a remote, unauthenticated attacker to submit crafted XML that can di...
Linux Distros Unpatched Vulnerability : CVE-2021-40690
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the secureValidation property is not passed...
Sangfor Behavior Management System 安全漏洞
Sangfor Behavior Management System is a behavior management software from China-based Sangfor. A security vulnerability exists in the Sangfor Behavior Management System that stems from an improperly configured XML parser, which could lead to internal file disclosure or server-side request forgery...
Linux Distros Unpatched Vulnerability : CVE-2018-1048
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOWENCODEDSLASH option and thus allow the the slash /...
Linux Distros Unpatched Vulnerability : CVE-2017-5595
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to...
GHSA-PP7P-Q8FX-2968 vite-plugin-static-copy files not included in `src` are possible to access with a crafted request
Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...
vite-plugin-static-copy files not included in `src` are possible to access with a crafted request
Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...
PT-2025-34242 · Vite · Vite-Plugin-Static-Copy
Name of the Vulnerable Software and Affected Versions: vite-plugin-static-copy versions prior to 2.3.2 vite-plugin-static-copy versions prior to 3.1.2 Description: The vite-plugin-static-copy plugin for Vite allows access to files not included in the src directory through a crafted request. This...
XML External Entity (XXE) Injection
Overview org.apache.tika:tika-parsers is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries. Affected versions of this package are vulnerable to XML External Entity XXE Injection. An attacker can access sensitive...
Linux Distros Unpatched Vulnerability : CVE-2018-1047
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method...
Linux Distros Unpatched Vulnerability : CVE-2023-3823
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables...
WeGIA 路径遍历漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A path traversal vulnerability exists in WeGIA versions prior to 3.4.8, which stems from a path traversal in the /html/socio/sistema/downloadremessa.php endpoint that could lead to a local file disclosure...
Linux Distros Unpatched Vulnerability : CVE-2020-12392
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user...
BIT-LIBPHP-2023-3823 Security issue with external entity loading in XML without enabling it
In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...
curl: Vulnerability Report: Local File Disclosure via file:// Protocol in cURL
Summary A security vulnerability has been identified that allows unauthorized local file system access via the file:// protocol in cURL, particularly when executed with elevated privileges e.g., sudo. This could lead to sensitive data exposure, including password hashes stored in /etc/shadow. Ste...
