2435 matches found
OPENSUSE-SU-2025:15642-1 ruby3.4-rubygem-rack-2.2-2.2.20-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.20-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2025-26859
RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...
CVE-2025-57741
An Incorrect Permission Assignment for Critical Resource vulnerability CWE-732 in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local attacker to run arbitrary code or commands via LaunchDaemon hijacking...
CVE-2025-2138
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security...
DEBIAN-CVE-2025-61919
Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, Rack::RequestPOST reads the entire request body into memory for Content-Type: application/x-www-form-urlencoded, calling rack.input.readnil without enforcing a length or cap. Large request bodies can therefo...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the maxDictSize parameter when processing large RAR files. An attacker can cause the application to crash or become unresponsive by supplying a specially crafted RAR archive that triggers...
CVE-2025-61859
CVE-2025-61859 (V-SFT) affects FUJI Electric V-SFT, specifically VS6ComFile!CItemDraw::is_motion_tween in versions 6.2.7.0 and earlier. The vulnerability is an out-of-bounds write, which opening specially crafted V-SFT files can cause information disclosure, ABEND, and arbitrary code execution. P...
CVE-2025-61788
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs metadata like title, description, etc. unfiltered and unmodified. The vulnerability allows attackers to...
EUVD-2025-33293
A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility...
WordPress Password only login plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Password only login versions = 0.2...
CVE-2025-3450
CVE-2025-3450 describes an Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime . Affected versions are before 6.3 and before Q4.93, where an unauthenticated, network-based attacker could delete data, leading to denial of service. The issue stems from resource lo...
WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Awesome Testimonials versions = 2.2.1...
EUVD-2021-11725
Malware in sbrugna...
Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936088)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936088 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avdictset function in dict.c. Tenable has extracted the preceding description bloc...
WordPress Featured Image from URL (FIFU) plugin <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Featured Image Custom Fields vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Featured Image from URL versions = 5.2.7...
CVE-2025-11336 Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads...
CVE-2025-59830
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...
AllStarLink Supermon 代码注入漏洞
AllStarLink Supermon is a web front-end management and monitoring tool from AllStarLink. A code injection vulnerability exists in AllStarLink Supermon 6.2 and earlier versions, which stems from unknown code in the AllMon2 component that could lead to a cross-site scripting attack...