RockyLinux 8 : resource-agents (RLSA-2026:1904)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:1904 advisory. pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-23490 Tenable has extracted the preceding description block direct...

CVE-2025-71184

A NULL pointer dereference vulnerability was found in the Linux kernel's Btrfs filesystem. When evicting an inode in btrfsevictinode, the tracing setup code attempts to fetch the root's ID before checking if the root pointer is NULL. This can cause a kernel crash when the inode's root is NULL...

CVE-2025-71184

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfsevictinode the root might be NULL, as...

EUVD-2018-20522

Malware in sbrugna...

EUVD-2020-0391

Malware in sbrugna...

EUVD-2013-5993

Malware in sbrugna...

EUVD-2022-4714

Malicious code in bioql PyPI...

CVE-2025-8702: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipulation of the argument ObjectID leads to...

Wanzhou WOES Intelligent Optimization Energy Saving System injection vulnerability

Wanzhou WOES Intelligent Optimization Energy Saving System is an Intelligent Optimization Energy Saving System from the Chinese company Wanzhou. An injection vulnerability exists in version 1.0 of the Wanzhou WOES Intelligent Optimization Energy Saving System, which is caused by incorrect...

CVE-2019-19729

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

@3kles/3kles-coremongodb (>=2.1.5, <=2.1.6), @akemona-org/strapi-connector-mongoose (>=3.13.0, <=3.16.2) +94 more potentially affected by CVE-2024-53900 via mongoose (>=8.0.0, <=8.8.2)

mongoose NPM version =8.0.0, =2.1.5, =3.13.0, =2.0.0, =0.0.34, =0.5.0, =0.4.3, =0.4.5, =0.4.12, =4.1.5, =1.3.5, =0.0.5, =8.3.1, =4.8.0, =1.0.0, =0.8.7, =0.8.13 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

SUSE CVE-2015-4411

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

SUSE CVE-2015-4410

The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service worker resource consumption or perform a cross-site scripting XSS attack via a crafted string...

@biscottino/session (>=1.0.0, <=1.0.1), @graasp/cli (>=0.3.0, <=0.4.2) +33 more potentially affected by CVE-2019-19729 via bson-objectid (>=1.1.1, <=1.3.0)

bson-objectid NPM version =1.1.1, =1.0.0, =0.3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.1.1, =2.0.0, =2.3.4 and more Source cves: CVE-2019-19729 Source advisory: GHSA-P84X-5XX8-HFF9...

@biscottino/session (>=1.0.0, <=1.0.1), @graasp/cli (>=0.3.0, <=0.4.2) +33 more potentially affected by CVE-2019-19729 via bson-objectid (>=1.1.1, <=1.3.0)

bson-objectid NPM version =1.1.1, =1.0.0, =0.3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.1.1, =2.0.0, =2.3.4 and more Source cves: CVE-2019-19729 Source advisory: OSV:GHSA-P84X-5XX8-HFF9...

bson-objectid contains Improper input validation

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

GHSA-P84X-5XX8-HFF9 bson-objectid contains Improper input validation

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

Broken Object Level Authorization☝️ — What you need to know

Broken Object Level Authorization☝️ — What you need to know What is Broken Object Level Authorisation? Broken Object Level Authorisation all starts with an object. Objects should be looked at in the context of “Object Oriented Programming”, what I mean with that is objects are the things you think...

PT-2021-27695

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a stack-buffer-overflow read crash. The crash involves the functions getoid, parse objectid, and parse asntype. No information is...

Design/Logic Flaw

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...