673 matches found
CVE-2025-66548 Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
CVE-2025-66548 Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
Deck app allows to spoof file extensions by using RTLO characters
None...
Malicious code in right_sailfish-silentdev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac91209ab385a0a436e5a849fe1054b5a3923cbb76d2304fcc94d5b748b3089a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-75793
Malicious code in rightsailfish-silentdev npm...
EUVD-2025-73927
Malicious code in rightanteaterz3n npm...
EUVD-2025-73926
Malicious code in rightdormouserequirement npm...
EUVD-2025-52263
Malicious code in right-azure-alligator npm...
EUVD-2025-52264
Malicious code in right-amethyst-tyrannosaurus npm...
EUVD-2025-52262
Malicious code in right-black-tapir npm...
EUVD-2025-52261
Malicious code in right-moccasin-hornet npm...
EUVD-2025-45514
Malicious code in rightfrogz3n npm...
[SECURITY] Fedora 42 Update: qt5-qtvirtualkeyboard-5.15.18-1.fc42
The Qt Virtual Keyboard project provides an input framework and reference key board frontend for Qt 5. Key features include: Customizable keyboard layouts and styles with dynamic switching. Predictive text input with word selection. Character preview and alternative character view. Automatic...
EUVD-2022-55676
The Core Config Manager CCM in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting XSS vulnerability via the search and deletion interfaces. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script ...
EUVD-2025-34930
Citizen vulnerable to stored XSS in sticky header button messages...
GHSA-G955-VW6W-V6PP Citizen vulnerable to stored XSS in sticky header button messages
Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...
The vulnerability of the `torch.bitwise_right_shift` interface in the PyTorch machine learning framework allows attackers to compromise the accessibility of protected information.
The vulnerability of the torch.bitwiserightshift interface in the PyTorch machine learning framework is related to the execution of the operation outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...
CVE-2025-62508 Citizen vulnerable to stored XSS in sticky header button messages
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...