2881 matches found
CVE-2022-49617 ASoC: Intel: sof_sdw: handle errors on card registration
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sofsdw: handle errors on card registration If the card registration fails, typically because of deferred probes, the device properties added for headset codecs are not removed, which leads to kernel oopses in driver...
Security Bulletin: IBM JRS (Jazz Reporting Service) uses a web link with untrusted references to an external site.
Summary IBM JRS Jazz Reporting Service uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims' web browser. The web application produces links to untrusted...
PT-2025-6524 · Progress Telerik · Kendoreact
Name of the Vulnerable Software and Affected Versions: Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0 Description: An attacker can introduce or modify properties within the global prototype chain, which can result in denial of service or command injection. Recommendations: For...
Progress Telerik UI 安全漏洞
Progress Telerik UI is a suite of UI user interface controls for application development from Progress, Inc. A security vulnerability exists in Progress Telerik UI that stems from an attacker being able to introduce or modify properties in the global prototype chain, which could result in a denia...
Astra Linux – Vulnerability in Zabbix
The HttpRequest object allows you to retrieve the HTTP headers from the server’s response after sending a request. The issue is that the returned strings are created directly from the data sent by the server and are not properly encoded for JavaScript. This enables the creation of internal string...
Astra Linux – Vulnerability in Zabbix
The implementation of atob in "Zabbix JS" allows for creating a string with arbitrary content and using it to access internal properties of objects...
Prototype Pollution
@tanstack/form-core is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object properties in the lib.mutateMergeDeep function, allowing attackers to inject properties into JavaScript prototypes by supplying a crafted payload...
CVE-2024-57084
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57084
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57084
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
dot-properties 安全漏洞
dot-properties is a library for parsing and stringifying .properties files in JavaScript by the individual developer Eemeli Aro. A security vulnerability exists in dot-properties version v1.0.1, which stems from the lib.parse function containing a prototype contamination vulnerability...
PT-2025-5773 · Unknown · Hot Properties
Name of the Vulnerable Software and Affected Versions: dot-properties version 1.0.1 Description: A prototype pollution in the lib.parse function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For dot-properties version 1.0.1, consider disabling...
CVE-2024-57084
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57084
CVE-2024-57084 affects the JavaScript library dot-properties v1.0.1. A prototype pollution vulnerability exists in the lib.parse function that allows an attacker to cause a Denial of Service (DoS) by sending a crafted payload. Connected sources corroborate the issue across multiple feeds (NVD, Re...
WordPress plugin tourmaster 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2025-24359
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...
When using an Oracle DB, application properties can't be set to empty
h3. Issue Summary The jira.security.csp.sandbox.included.content.disposition application property accepts: Empty value "attachment" "inline" "attachment;inline" or "inline;attachment" If Jira is installed using an Oracle database, the empty value is never set. This happens because Oracle treats...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure due to improper handling of property access on reflection types and static properties/fields. An attacker can list installed nuget packages' names and versions through attributes and base types they require by...
Property reflection in System.Linq.Dynamic.Core
An issue in System.Linq.Dynamic.Core versions before v.1.6.0 allow remote access to properties on reflection types and static properties/fields...