3046 matches found
GHSA-4RQF-8PFM-P36R MLflow has a Local File Read/Path Traversal in dbfs
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...
CVE-2024-9900 Cross-Site Scripting (XSS) in mudler/localai
mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...
SUSE-SU-2025:20151-1 Security update for tpm2.0-tools, tpm2-0-tss
This update for tpm2.0-tools, tpm2-0-tss fixes the following issues: tpm2-0-tss: Update to version 4.1: + Security - CVE-2024-29040: arbitrary quote data may go undetected by FapiVerifyQuote bsc1223690 + Fixed - fapi: Fix length check on FAPI auth callbacks - mu: Correct error message for errors ...
IOBit Malware Fighter 安全漏洞
IOBit Malware Fighter is a suite of antivirus software for Windows-based platforms from IOBit. The program has features such as anti-malware and virus protection. A security vulnerability exists in IOBit Malware Fighter version v12.1.0, which originates from the exposure of the IMFForceDelete...
PT-2025-11254
Name of the Vulnerable Software and Affected Versions: Civi - Job Board & Freelance Marketplace WordPress Theme plugin versions up to, and including, 2.1.4 Description: The issue is due to a lack of user validation before changing a password, making it possible for unauthenticated attackers to...
WordPress WP JobHunt plugin <= 7.1 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by Tonn in WordPress Plugin WP JobHunt versions = 7.1...
WordPress WP JobHunt plugin <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover vulnerability
Unauthenticated Privilege Escalation via Password Reset/Account Takeover vulnerability discovered by Tonn in WordPress Plugin WP JobHunt versions = 7.1...
Unspecified Vulnerability in IBM EntireX
IBM EntireX is a versatile middleware solution from International Business Machines IBM designed to facilitate seamless integration between core enterprise applications and modern applications. A security vulnerability exists in IBM EntireX version 11.1, which stems from a security issue that can...
Santesoft Sante PACS Server 安全漏洞
Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. Used to store, archive, manage, view and burn medical images. A security vulnerability exists in Santesoft San...
Santesoft Sante PACS Server 安全漏洞
Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. Used to store, archive, manage, view and burn medical images. A security vulnerability exists in Santesoft San...
CVE-2025-27101
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...
CVE-2025-27101 Broken Access Control in Opal filesystem's copy functionality exposes all user data
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...
CVE-2025-27178
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2025-27175
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
WordPress plugin Bee Layer Slider 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress plugin ZipList Recipe 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
Adobe InDesign 代码问题漏洞
Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. A null pointer dereference vulnerability exists in Adobe InDesign ID20.1, ID19.5.2 and earlier versions, which can be exploited by an attacker to cause a denial of service in the application...
Opal 路径遍历漏洞
Opal is an Open Source Software for Epidemiology open source core database application for biobanking or epidemiology research. A path traversal vulnerability exists in Opal versions prior to 5.1.1, which stems from a copy of a parent directory that could disclose files to which a user is not...
VisiCut 代码问题漏洞
VisiCut is a tool by Thomas Oster, a personal developer. A security vulnerability exists in VisiCut version 2.1, which stems from unsafe XML deserialization in the loadPlfFile method of VisiCutModel.java, which could lead to code execution...
