yimioa 安全漏洞

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from improper access control of the WebSecurityConfig component and allows an unauthorized attacker to arbitrarily change the...

CVE-2025-20920

Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...

SUSE CVE-2025-27154

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...

AZL-57327 CVE-2025-26598 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...

Vim 资源管理错误漏洞

Vim is a cross-platform text editor open-sourced by Vim. A resource management error vulnerability exists in Vim versions prior to 9.1.1115, which stems from memory reuse after release...

PT-2025-7078

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2024.1.6 Description: The issue concerns a potential man-in-the-middle attack due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

CVE-2022-4609

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...

UBUNTU-CVE-2025-1018

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability affects Firefox 135 and Thunderbird 135...

PT-2025-5394 · Unknown · Alexandros Georgiou Bitcoin/Altcoin Wallets

Name of the Vulnerable Software and Affected Versions: Alexandros Georgiou Bitcoin and Altcoin Wallets versions prior to 6.3.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS attacks, specifically Reflecte...

WordPress plugin Cookie Consent & Autoblock for GDPR/CCPA 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

JFinalOA 安全漏洞

JFinalOA is an enterprise office system developed on the JFinal framework by rabbit individual developers. A security vulnerability exists in JFinalOA versions prior to v2025.01.01. An attacker exploiting this vulnerability could execute arbitrary web script or HTML via a specially crafted payloa...

iocharger 安全漏洞

iocharger is an electric vehicle charging and smart energy management solution from the Chinese company Galaxy Zhangtan iocharger. A security vulnerability exists in iocharger versions prior to 24120701, which stems from an unsatisfactory neutralization of a special element used in a command, whi...

PT-2024-36794 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.16 Description: An Improper URL Handling issue allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This issue is triggered via the "real-browser" request typ...

PT-2024-39883 · Ivanti · Ivanti Automation

Name of the Vulnerable Software and Affected Versions: Ivanti Automation versions prior to 2024.4.0.1 Description: Under specific circumstances, insecure permissions in Ivanti Automation allow a local authenticated attacker to achieve local privilege escalation. Recommendations: For versions prio...

PT-2024-39056 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions prior to 10.18.40.0 Description: Under specific circumstances, insecure permissions in Ivanti Workspace Control allow a local authenticated attacker to achieve local privilege escalation. Recommendations: For...

AZL-53978 CVE-2024-54661 affecting package socat for versions less than 1.7.4.3-2

readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in PDFium in Google Chrome prior to version 128.0.6613.84 allowed a remote attacker to perform an out-of-bounds memory read through a crafted PDF file. Chromium security severity: Medium...

PDF Viewer Macro 安全漏洞

PDF Viewer Macro is an open source macro for XWiki SAS. It allows viewing PDF files attached to XWiki pages from within the XWiki page. A security vulnerability exists in PDF Viewer Macro prior to version 2.5.6, which stems from a PDF Viewer Macro that allows an attacker to view any attachment...

PT-2024-22640 · Intel · Intel Ipp

Name of the Vulnerable Software and Affected Versions: IntelR IPP software for Windows versions prior to 2021.12.0 Description: The issue is related to an uncontrolled search path in some IntelR IPP software for Windows, which may allow an authenticated user to potentially enable escalation of...

WordPress plugin Appointment Booking Calendar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...