CVE-2026-24910

In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...

CVE-2026-24910

In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...

CVE-2024-39904

VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example,...

Linkwarden 安全漏洞

Linkwarden is a self-hosted collaborative bookmark manager from Linkwarden Open Source. A security vulnerability exists in Linkwarden version 2.10.2, which stems from an unvalidated file:// link and could lead to a data leak...

CVE-2024-1493

An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code with the victim's privileges. Successful exploitation requires the malicious party to trick the victim into openi...

Trend Micro Deep Security Agent Privilege Escalation

The vulnerability of the Trend Micro Deep Security Agent lies in the incorrect handling of the link before accessing a file. Exploiting this vulnerability can allow attackers to enhance their privileges...

Trend Micro Deep Security Agent File Access DoS

The vulnerability of the Trend Micro Deep Security Agent lies in the improper handling of the link before accessing a file. Exploiting this vulnerability can allow an attacker to trigger a service failure...

OESA-2024-2431 python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...

VulnCheck KEV: CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2024-39904

VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example,...

CVE-2024-39904

VNote (note‑taking platform) before version 3.18.1 is affected by a code execution vulnerability that can be triggered via crafted notes containing local file references (for example, file:///C:/WINDOWS/system32/cmd.exe or calc.exe). The underlying issue is a local file path handling/URI embeddin...

3D Builder Buffer Overflow

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing PLY format files. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading...

SUSE CVE-2008-4910

The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument to the showDocument method...

Cross site scripting

In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $filelink in class/KippoInput.class.php...

kippo-graph 跨站脚本漏洞

kippo-graph is a full-featured script by the individual developer Ioannis Koniaris. It is used to visualize statistics for Kippo-based SSH honeypots. A security vulnerability exists in kippo-graph versions prior to 1.5.1, which stems from a cross-site scripting vulnerability in $filelink in...

CVE-2021-41750

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

CVE-2021-41750: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

PT-2022-11474

Name of the Vulnerable Software and Affected Versions SEOmatic plugin version 3.4.10 for Craft CMS 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via a GET to "/index.php?action=seomatic/file/seo-file-link" with url parameter containing the...

Nystudio107 Seomatic 跨站脚本漏洞

Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.10, which can be exploited by a remote attacker to inject...