PT-2026-5976

Name of the Vulnerable Software and Affected Versions NetBox versions 2.11.0 through 3.7.x Description A reflected cross-site scripting XSS issue exists in the ProtectedError handling logic. Object names are included in HTML error messages without proper escaping, allowing user-controlled content...

CVE-2025-69848

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting XSS vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper...

NetBox 安全漏洞

NetBox is a tool developed by the NetBox community, based on Django and PostgreSQL, for IP address management IPAM and data center infrastructure management DCIM. There are security vulnerabilities in versions 2.11.0 to 3.7.x of NetBox. These vulnerabilities stem from the ProtectedError processin...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05124)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious script via an error message containing a specially crafted object name...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to free kernel object names after a device registration failure, which could lead to a memory leak...

CVE-2020-36889

Kentico Xperience stores error messages containing crafted object names in the Administration Interface, enabling a stored XSS vulnerability. Affected: Kentico Xperience

CVE-2020-36889 Kentico Xperience <= 12.0.90 Administration Interface Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users' browsers when administrators view error messages in the administration...

PT-2025-52297

Name of the Vulnerable Software and Affected Versions Kentico Xperience affected versions not specified Description A stored cross-site scripting issue exists in Kentico Xperience. Attackers can inject malicious scripts through error messages that contain specially crafted object names. This allo...

CLSA-2025-1758293394 postgresql: Fix of 2 CVEs

CVE-2025-8714: prevent execution of unsafe meta-commands in plain-text dumps pgdump/pgrestore/pgdumpall, psql restricted mode - CVE-2025-8715: sanitize newlines in object names to avoid unsafe SQL comments in dumps...

Updated postgresql15 & postgresql13 packages fix security vulnerabilities

PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table. CVE-2025-8713 PostgreSQL pgdump lets superuser of origin server execute arbitrary code in psql client. CVE-2025-8714 PostgreSQL pgdump newline in object name executes arbitrary code in psql client an...

DEBIAN-CVE-2025-8715

Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks...

CVE-2025-8715

Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks...

Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

iTop 安全漏洞

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 3.1.1 and 3.2.0, which stems from a cross-site scripting attack that can be executed by populating an object's friendly name/supplemental name with malicious code when the...

Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li [email protected] Patches commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT...

K12252011: OpenSSH vulnerability CVE-2019-6109

Security Advisory Description An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional...

AZL-36987 CVE-2018-14628 affecting package samba 4.18.3-2

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Samba 安全漏洞

Samba is a standard Windows interoperability program suite for Linux and Unix. Samba has a security vulnerability that stems from a lack of access control checks. An attacker could exploit the vulnerability to obtain the names and retained attributes of deleted objects in the LDAP store...

F5 Networks BIG-IP : OpenSSH vulnerability (K12252011)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K12252011 advisory. An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicio...

CVE-2022-43569

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting XSS in the object name of a Data Model...