376 matches found
CVE-2025-46398 Xfig: fig2dev stack-overflow via read_objects
In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via readobjects function...
CVE-2025-46397 Xfig: xfig: stack-overflow allows possible code execution via local input manipulation
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function...
CVE-2025-46397 Xfig: xfig: stack-overflow allows possible code execution via local input manipulation
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function...
CVE-2025-46397
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function...
CVE-2025-46397
CVE-2025-46397 is a vulnerability in xfig/fig2dev where a stack overflow via local input manipulation in the bezier_spline function could lead to code execution. The issue is triggered by crafted input to the utility that processes FIG/PIC figures. Public advisories (AlmaLinux, Debian LTS, Astra)...
CVE-2025-32951
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends...
PT-2025-17432 · Unknown · Ova Connect Installer
Name of the Vulnerable Software and Affected Versions: OVA Connect Installer affected versions not specified Description: An improper neutralization of input issue was identified in the End of Life EOL OVA based connect installer component. This component was deprecated in September 2023 with end...
CVE-2025-3821
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file add-admin.php. The manipulation of the argument txtpassword/txtfullname/txtemail leads to cross site scripting. Th...
📄 Plane 0.23.1 Server-Side Request Forgery
Plane version 0.23.1 suffers from a server-side request forgery vulnerability. Exploit Title: Plane - Server side request forgery SSRF Date: 2024-01-13 Exploit Author: Saud Alenazi Vendor Homepage: https://plane.so Software Link: https://github.com/makeplane/plane/releases/tag/v0.23.1 Version:...
OESA-2025-1407 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes:...
Path Traversal
org.noear:solon-view is vulnerable to path traversal. The vulnerability is due to insufficient validation of user input in the rendermav function, which allows the manipulation of the template argument to perform path traversal...
spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length
A flaw was found in the spring-security-core password encoder. This vulnerability allows incorrect password matching via input manipulation...
CVE-2025-2969
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been rated as problematic. This issue affects the function Save of the component Feature Link Block Handler. The manipulation of the argument Title/Body Source/Button Text leads to cross site scripting. The attack may be initiated...
SUSE CVE-2025-31163
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via putpatternarc function...
SUSE CVE-2025-31164
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via createlinewithspline...
Out-of-bounds Write
Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Out-of-bounds Write when using @torch.jit.script. An attacker can corrupt memory by manipulating the function's input. Note: This is only exploitable ...
Cross-site Scripting (XSS)
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Title/Body source fields. An attacker can inject malicious scripts by crafting malicious input to these fields. Details...
CVE-2025-31163
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via putpatternarc function...