14146 matches found
PT-2025-36908
Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...
CVE-2025-57665
The Element Plus UI component library (NPM) is vulnerable to insufficient input validation in the el-link component through version 2.10.6 . The component fails to perform protocol validation, URL sanitization, or security header enforcement on user-controlled href attributes, passing them direct...
VGT+ Component Privilege Escalation
The vulnerability of the VGT+ component in Mellanox OFED and NVIDIA DOCA-Host packages is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and cause service failures...
CVE-2025-57665: Improper Neutralization of Input During Web Page Generation
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
@142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.24), @17mkh/ui (0.0.2) +1232 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0, <=2.11.2)
element-plus NPM version =1.0.1-beta.0, =0.0.1-alpha.14, =1.0.0-beta.1, =0.6.1-annotator.1, =1.1.2, =2.4.2-beta.1, =1.1.2, =0.7.0-annotator.0, =1.0.3, =1.4.2, =1.0.1, =3.72.0, =2.0.1, =2.1.0 and more Source cves: CVE-2025-57665 Source advisory: MEND:CVE-2025-57665...
PT-2025-36893
Name of the Vulnerable Software and Affected Versions: Microsoft Office Plus affected versions not specified Description: The software contains an issue that allows an unauthorized attacker to perform spoofing over a network, potentially leading to exposure of sensitive information...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
Element Plus security vulnerabilities
Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-55243: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...
Malicious Package
Overview tailwind-typography-plus is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances...
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
...
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
...
CVE-2025-58625
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...
ManageEngine ServiceDesk Plus < 15.1 Build 15110 Privilege Escalation
The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 15.1 Build 15110. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2025-8309 advisory. - A privilege escalation vulnerability caused by the overly permissive regular expression...
ManageEngine ServiceDesk Plus MSP < 14.9 Build 14940 Privilege Escalation
The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.9 Build 14940. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-8309 advisory. - A privilege escalation vulnerability caused by the overly permissive regular expression regex...