CVE-2024-26290 Authenticated Remote Command Injection affecting Avid NEXIS

Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance SDA+ on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS...

CVE-2024-26290

CVE-2024-26290 affects Avid NEXIS E-series, F-series, PRO+ on Linux and Avid System Director Appliance (SDA+) on Linux. The root cause is improper input validation that enables code execution with root privileges on the underlying OS. Affected versions can be before 2024.6.0 for all listed produc...

Path Traversal

Rack is vulnerable to Path Traversal. The vulnerability is due to improper input validation due to Rack::Static not correctly sanitizing user-supplied paths, allowing encoded path traversal sequences to access files outside the intended static file directory...

Avid NEXIS 安全漏洞

Avid NEXIS is a software-defined storage platform designed for media storage and management from Avid. It is used by media organizations to accelerate production, improve efficiency, and support co-production. A security vulnerability exists in Avid NEXIS versions prior to 2024.6.0 that stems fro...

CVE-2025-28943

CVE-2025-28943 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “DP ALTerminator – Missing ALT manager.” The issue arises from improper input neutralization during web page generation, allowing stored XSS. Affected versions are up to 1.0.2 (n/a through 1.0.2). C...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Fileupload and Apache Tomcat

Summary Vulnerabilities have been identified in Apache Commons Fileupload and Apache Tomcat which are used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2016-3092 DESCRIPTIO...

CVE-2025-26702

CVE-2025-26702 affects ZTE GoldenDB (versions 6.1.03 through 6.1.03.04). The issue is an improper input validation vulnerability that allows input data manipulation. CVSSv3.1 vectors indicate network attack with no authentication, low attack complexity, and high impact on availability (base score...

Siemens SCALANCE M-800 and SC-600 Families

SUMMARY SCALANCE M-800 and SC-600 families are affected by improper input validation in the OpenVPN authentication. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific...

WordPress plugin Tabbed Login Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

FreeBSD : vim -- Improper Input Validation in Vim (2ec7816d-fdb7-11ef-91ff-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ec7816d-fdb7-11ef-91ff-b42e991fc52e advisory. [email protected] reports: Vim is distributed with the tar.vim plugin, that allows easy...

CLSA-2025-1741635651 cups: Fix of CVE-2024-47175

CVE-2024-47175: fix improper input validation in cups for PPD files...

CVE-2025-27253

CVE-2025-27253 affects GE Vernova UR IED family devices (versions 7.0–8.60). The vulnerability is CWE-15: External Control of System or Configuration Setting, caused by improper input validation that allows an attacker to provide input which establishes a TCP connection via port forwarding. Lack ...

Server-side Template Injection (SSTI)

spacyllm is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper input validation in the template field, allowing attackers to execute Remote Code Execution RCE by injecting a crafted payload...

Improper Input Validation in Vim

...

CVE-2023-35894

IBM Control Center (IBM Sterling Control Center) versions 6.2.1 and 6.3.1 are affected by CVE-2023-35894 due to improper validation of HOST header input, enabling HTTP header injection that can lead to cross-site scripting, cache poisoning, or session hijacking. Remediation per IBM bulletin: upgr...

Projectworlds Life Insurance Management System 注入漏洞

Projectworlds Life Insurance Management System is a life insurance management system from Projectworlds India. An injection vulnerability exists in Projectworlds Life Insurance Management System version 1.0, which stems from improper manipulation of the key parameter and could lead to an SQL...

Projectworlds Life Insurance Management System 注入漏洞

Projectworlds Life Insurance Management System is a life insurance management system from Projectworlds India. An injection vulnerability exists in Projectworlds Life Insurance Management System version 1.0, which stems from improper manipulation of the reciptno parameter and can lead to SQL...

UBUNTU-CVE-2024-38311

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue...

CVE-2024-38311 Apache Traffic Server: Request smuggling via pipelining after a chunked message body

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue...

CVE-2024-38311

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue...