4285 matches found
Gitea security vulnerabilities
Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions prior to 1.22.5, which stems from insufficient execution of branch delete permissions after a merge pull request...
CVE-2025-68940
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request...
CVE-2025-68940: Incorrect Authorization
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request...
CVE-2025-13706
Tencent PatrickStar mergecheckpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent PatrickStar. User interaction is required to exploit this vulnerability in that the...
CVE-2025-13712
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
CLSA-2025-1766599216 Fix CVE(s): CVE-2025-14178
SECURITY UPDATE: Heap buffer overflow in arraymerge - debian/patches/CVE-2025-14178.patch: add validation to check if total element count exceeds HTMAXSIZE before allocation. - CVE-2025-14178...
EUVD-2025-204977
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
CVE-2025-13706
Tencent PatrickStar mergecheckpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent PatrickStar. User interaction is required to exploit this vulnerability in that the...
CVE-2025-13712
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
CVE-2025-13706
This CVE concerns Tencent PatrickStar’s merge_checkpoint endpoint, where deserialization of untrusted data enables remote code execution. Impact: attacker can execute code with root privileges after user visits a crafted page/file. Root cause: insufficient validation of user-supplied data in the ...
CVE-2025-13712 Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
CVE-2025-13712
CVE-2025-13712 affects Tencent HunyuanDiT via the merge endpoint, where deserialization of untrusted data can lead to Remote Code Execution with root privileges. The flaw arises from missing validation of user-supplied data. Public sources (ZDI-25-1028 and related records) confirm the vulnerabili...
CVE-2025-13712 Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
CVE-2025-13712 Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
Tencent HunyuanDiT code issue and vulnerabilities
Tencent HunyuanDiT is a diffusion model from Tencent China. A code issue vulnerability exists in Tencent HunyuanDiT that stems from a lack of validation of user-supplied data in the merge endpoint, which could lead to deserialization of untrusted data and remote code execution...
Tencent PatrickStar code issues and vulnerabilities
Tencent PatrickStar is a distributed deep learning training framework from Tencent China. A code issue vulnerability exists in Tencent PatrickStar that stems from a lack of validation of user-supplied data in the mergecheckpoint endpoint, which could lead to deserialization of untrusted data and...
CVE-2025-13712: Deserialization of Untrusted Data
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must...
MGASA-2025-0330 Updated php packages fix security vulnerabilities
Opcache: - Reset global pointers to prevent use-after-free in zendjitstatus. PDO: - Fixed PDO quoting result null deref. Standard: - Fixed Null byte termination in dnsgetrecord - Heap buffer overflow in arraymerge - Information Leak of Memory in getimagesize...
Updated php packages fix security vulnerabilities
Opcache: - Reset global pointers to prevent use-after-free in zendjitstatus. PDO: - Fixed PDO quoting result null deref. Standard: - Fixed Null byte termination in dnsgetrecord - Heap buffer overflow in arraymerge - Information Leak of Memory in getimagesize...
BIT-GITLAB-2025-12734 Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into...