Azure File Sync Agent v20.0 Release – February 2025 (KB5041884)

Update Rollup for Azure File Sync agent version 20.0.0.0. For more details, see the associated Microsoft Knowledge Base article...

Vulnerability fixed in NetApp SnapCenter

NetApp has fixed a vulnerability in SnapCenter Specifically for versions earlier than 6.0.1P1 and 6.1P1. The vulnerability is in the way SnapCenter handles authenticated users. This allows authenticated users to gain administrative access on remote systems equipped with the SnapCenter plug-in. Th...

CVE-2025-27832

The CVE-2025-27832 issue affects Ghostscript prior to 10.05.0, specifically the NPDL device’s Compression buffer in contrib/japanese/gdevnpdl.c, which leads to a buffer/integer overflow. Public reports from multiple sources (e.g., ALAS/Amazon Linux advisories and Astra Linux bulletin) confirm the...

CVE-2025-30521 WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in giangmd93 GP Back To Top allows Cross Site Request Forgery. This issue affects GP Back To Top: from n/a through 3.0...

WordPress WP Colorful Tag Cloud plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Colorful Tag Cloud versions = 2.0.1...

Digiwin ERP 代码问题漏洞

Digiwin ERP is an e-commerce platform from China Dingxin Digiwin. A code issue vulnerability exists in Digiwin ERP version 5.0.1, which originates from an unrestricted upload and could lead to a remote attack...

CVE-2025-30347

Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects...

Jinher OA C6 安全漏洞

Jinher OA C6 is a digital office platform of China Jinhe Jinher Company. A security vulnerability exists in Jinher OA C6 version 1.0, which stems from improper manipulation of the httpOID parameter in the IncentivePlanFulfillAppprove.aspx file, which could lead to a SQL injection attack...

Improper Verification of Source of a Communication Channel

Overview Flask-Cors is an A Flask extension adding a decorator for CORS support Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel due to improper application of regex path matching rules. An attacker can gain unauthorized cross-origin...

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal enabling the deletion of files on the target server. An attacker can delete critical files such as polyaxon.sock to cause a crash of the API container. PoC python import requests url =...

CVE-2025-0190

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these...

CVE-2024-12866 Local File Inclusion in netease-youdao/qanything

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration...

CVE-2024-12866

CVE-2024-12866 affects netease-youdao/qanything v2.0.0. It is a local file inclusion (path traversal) vulnerability caused by an unvalidated file path to an access-restricted directory, enabling reading arbitrary files on the filesystem and potentially facilitating remote code execution via sensi...

CVE-2024-8101 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be...

CVE-2024-12778

CVE-2024-12778 affects the Aim project (aimhubio/aim) v3.25.0. The root cause is an absence of a limit on the number of metrics requested per call, which, together with a single-threaded server, allows excessive resource consumption and can render the web API unresponsive (DoS). Concretely, retri...

Audi Universal Traffic Recorder App 安全漏洞

The Audi Universal Traffic Recorder App is a special app for traffic recorders from Audi, which can be used to connect to a traffic recorder, view previews, lock videos, and other operations. A security vulnerability exists in the Audi Universal Traffic Recorder App version 2.0, which stems from...

Xpdf 安全漏洞

Xpdf is a free PDF viewer and toolkit from Xpdf, Inc. that includes a text extractor, image converter, HTML converter, and more. A security vulnerability exists in Xpdf 4.05 and earlier versions, which stems from an integer overflow checking error in the PostScript function interpreter code,...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

iBanking 安全漏洞

iBanking is an information system by Martin Mbithi Personal Developer. A security vulnerability exists in iBanking version v2.0.0, which stems from an arbitrary file upload vulnerability in the Client Profile Update section that could lead to the execution of arbitrary code...