advisory-database

Python 패키징 보안 권고 데이터베이스 이 저장소는 https://pypi.org에 게시된 패키지에 대한 보안 권고를 커뮤니티가 소유한 저장소입니다. 보안 권고는 vulns 디렉토리에 있으며 간단한 형식의 YAML 인코딩을 사용합니다. 보안 권고 기여하기 풀 리퀘스트 만들기 기존 항목은 풀 리퀘스트를 생성하여 간단히 편집할 수 있습니다. 새 항목을 도입하려면 PYSEC-0000-.yaml 이름과 일치하는 새 파일로 풀 리퀘스트를 생성하세요. 병합되면 자동화가 적절한 ID를 할당하기 위해 나중에 이를 처리합니다. YAML 파...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100353)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100353 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: message: mptlan: Fix use after free bug in mptlanremove due to race condition mptlanprobe...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100751)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100751 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: sca3000: Fix a resource leak in sca3000probe spi-irq from requestthreadedirq not released wh...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101313 advisory. Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Tenable has extract...

BELL-CVE-2026-68178

Bulletin has no description...

SSRF (Server-Side Request Forgery) axios Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with...

CVE-2024-3938

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...

CVE-2024-3938

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...

CVE-2024-24192

CVE-2024-24192 affects robdns, with a heap overflow in the code path handling block->filename in /src/zonefile-insertion.c (version d76d2e6). Multiple connected sources corroborate the issue and identify the vulnerable component as block->filename and the function zonefile-insertion.c. PT-2...

CVE-2022-25038

wanEditor v4.7.11 was discovered to contain a cross-site scripting XSS vulnerability via the video upload function...

CVE-2024-4356

The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-35512

hmq v1.5.5 is vulnerable to Denial of Service DoS due to a Null Pointer Exception. A remote attacker can trigger a broker crash by sending a specially crafted MQTT UNSUBSCRIBE packet with an illegal control character Topic. The failure to properly validate this field leads to a null pointer...

CVE-2022-45171

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions...

CVE-2024-34852

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiverschedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful...

CVE-2021-47570

CVE-2021-47570 is addressed in the Linux kernel staging area (rt8188eu driver). The issue was a memory leak in rtw_wx_read32() where ptmp was not freed before returning -EINVAL. A fix (memory cleanup) has been applied to resolve this vulnerability; references point to kernel stable commits that i...

CVE-2024-5298

D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existi...

CVE-2024-22026

A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance...

CVE-2024-29850

Veeam Backup Enterprise Manager allows account takeover via NTLM relay...

CVE-2021-47439

In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Added the condition for scheduling kszmibreadwork When the ksz module is installed and removed using rmmod, kernel crashes with null pointer dereferrence error. During rmmod, kszswitchremove function tries to...

CVE-2021-47291

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix another slab-out-of-bounds in fib6nhflushexceptions While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 "ipv6: Fix KASAN:...