Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the DML component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network. Details Denial of Service DoS describes a family of attacks, all aimed at making a...

Use After Free

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Use After Free via improper handling of possible socket destruction in P2PSocketTcpBase. An attacker can...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to insufficient validation of memory allocation before use in the decodeinit function. An attacker can cause an application crash by tricking a user into opening a specially crafted ALS file which leads to...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the StreamImage function in the stream.c file. An attacker can cause resource exhaustion by submitting specially crafted image files. Remediation A fix was pushed into the master branch but not yet published...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the preHandle function of the AuthorizationInterceptor.java component. An attacker can gain unauthorized access to restricted resources by manipulating the Request argument remotely. Remediation A fix was pushed...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SplitRTR function in the rtr.go file, which allows access to data without checking the input length. An attacker can cause a denial of service by sending specially crafted input. Remediation Upgrade...

i3c: Add NULL pointer check in i3c_master_queue_ibi()

...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Transfer-Encoding: chunked process. An attacker can exhaust server memory resources by sending specially crafted HTTP requests with chunked transfer encoding or without a...

CVE-2025-45662

A cross-site scripting XSS vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the gnutlsfigurecommonciphersuite function. Remediation A fix was pushed into the master branch but not yet published. References - Fix Commit - PoC - Red Hat Bugzilla Bug - Release Notes Credit: Stefan Bühl...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the SCT extension parsing process. An attacker can access confidential information by providing a specially crafted certificate containing a malformed SCT extension during X.509 certificate verificatio...

Parse Server 安全漏洞

Parse Server is an open source backend from Parse Platform Open Source that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 5.3.0 through 7.5.3 and prior to 8.2.2, which stems from the GraphQL API not validating a sessi...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the gdkpixbuf process. An attacker can cause a denial of service by sending specially crafted image files that trigger a heap buffer overflow. Remediation Upgrade gdk-pixbuf to version 2.44.4 or higher. Reference...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the stack-overflow handler in ljstate.c. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit - GitHub Gist - GitHub Issue Credit: Kutyavin Maxim...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the ljstrfmtwfnum function in ljstrfmtnum.c. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit - GitHub Gist - GitHub Issue Credit: Kutyavin Maxim...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow due to improper validation during parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffe...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the scanruns function in the MMRDecoder component. An attacker can cause heap corruption or read sensitive memory by providing specially crafted input that causes the xr pointer to write or read outside the bound...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the BigDecimal and BigInteger handling in the MessageSerializer class. An attacker can execute arbitrary code or manipulate application behavior by providing crafted serialized objects. Details...

Relative Path Traversal

Overview mikopbx/core is a Free PBX system for SMB based on Asterisk Affected versions of this package are vulnerable to Relative Path Traversal via the PostController.php process. An attacker can execute arbitrary code and access sensitive files by uploading a crafted PHP script to an arbitrary...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the process handling HTTP header fields. An attacker can cause excessive memory consumption and potentially crash or render the server unresponsive by sending a large number of HTTP headers. Details Denial of...