3176 matches found
CVE-2019-16151
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's...
Malicious code in pydefender (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a1e2cc2d94eff74e302118c35c34f87e76175fe507facbe21c29883960c8223e setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals...
PT-2025-8948 · Apple · Ios +2
Name of the Vulnerable Software and Affected Versions: iOS version 18.2.1 Description: A zero-click attack on an iOS device leverages a vulnerability in Core Media, allowing attackers to deliver a malicious iMessage containing a specially crafted HEIF image. The exploit bypasses Apple’s BlastDoor...
UBUNTU-CVE-2022-49666
In the Linux kernel, the following vulnerability has been resolved: powerpc/memhotplug: Add addpages override for PPC With commit ffa0b64e3be5 "powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit" the kernel now validate the addr against highmemory value. This results in the below BUGON with da...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from an addpages override in powerpc/memhotplug that causes BUGON...
Atos Eviden IDRA和Atos Eviden IDCA 安全漏洞
Atos Eviden IDRA and Atos Eviden IDCA are both applications from Atos France. A security vulnerability exists in Atos Eviden IDRA and Atos Eviden IDCA that stems from the presence of a multi-partition privilege override that can lead to the disclosure of sensitive data...
MAL-2025-191803 Malicious code in network-utils-simple (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d During installation, there is an attempt to download and execute code. The package has no real functionality. --- Category: MALICIOUS - The campaign has clearl...
Malicious code in network-utils-simple (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d During installation, there is an attempt to download and execute code. The package has no real functionality. --- Category: MALICIOUS - The campaign has clearl...
CVE-2024-31866
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELININTPCLASSPATHOVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to...
FreeBSD : Gitlab -- Vulnerabilities (1a8c5720-e9cf-11ef-9e96-2cf05da270f3)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1a8c5720-e9cf-11ef-9e96-2cf05da270f3 advisory. Gitlab reports: A CSP-bypass XSS in merge-request page Denial of Service due to Unbounded Symb...
Gitlab -- Vulnerabilities
Gitlab reports: A CSP-bypass XSS in merge-request page Denial of Service due to Unbounded Symbol Creation Exfiltrate content from private issues using Prompt Injection A custom permission may allow overriding Repository settings Internal HTTP header leak via route confusion in workhorse SSRF via...
Astra Linux – Vulnerability in gst-plugins-base1.0
GStreamer is a library for constructing graphs of media-handling components. A OOB-write vulnerability has been identified in the gstssaparse.c file’s gstssaparseremoveoverridecodes function. This function is responsible for parsing and removing SSA SubStation Alpha style override codes, which ar...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: signal: restored the overriderlimit logic Before committing the change d64696905554 “Reimplemented RLIMITSIGPENDING based on ucounts”, the R LIMIT for UCOUNTRLIMITSIGPENDING was not enforced for certain types of signals. However,...
CVE-2022-45064
The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and...
WordPress Target Video Easy Publish plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via bridoverrideyt Shortcode vulnerability discovered by SOPROBRO in WordPress Plugin Target Video Easy Publish versions = 3.8.3...
CVE-2024-54461
The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...
CVE-2024-54462 Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites
The file names constructed within imagepicker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could...
CVE-2024-54461
CVE-2024-54461 affects file_selector_android (Flutter). The issue is unsanitized/cleanup-lacking filenames in file_selector’s file choosing, allowing a malicious document provider to select a file and potentially overwrite internal files in the app cache. A fix exists in 0.5.1+12; update to the l...