Django annotate alias Code Execution

The vulnerability of the LoginView, LogoutView, and setlanguage functions in the Django web application framework is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Fedora: Security Advisory (FEDORA-2025-6ecd8d4f9b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-ca5f759234)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : python-deepdiff / python-orderly-set (2025-ca5f759234)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-ca5f759234 advisory. Update to 8.6.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848

The D-Link DIR-823X wireless router contains a Remote Code Execution (RCE) vulnerability in its set_cassword() settings interface. The root cause is the lack of proper input validation or cleaning for the http_casswd parameter, which fails to filter special characters like & . This allows an atta...

PT-2025-39697

Name of the Vulnerable Software and Affected Versions get-jwks versions prior to 11.0.2 Description A flaw exists in the get-jwks library related to its JWKS key-fetching mechanism. When the issuer iss claim is validated after keys are retrieved from the cache, cached keys from an unexpected issu...

Fedora 42 : python-deepdiff / python-orderly-set (2025-6ecd8d4f9b)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-6ecd8d4f9b advisory. Update to 8.6.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

GHSA-76G8-235F-GJ6P dref is vulnerable to prototype pollution

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

Prototype Pollution

Overview dref is a deep object refs Affected versions of this package are vulnerable to Prototype Pollution via the lib.set function. An attacker can cause a denial of service by supplying a specially crafted payload. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype...

CVE-2025-26278

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

BIT-DJANGO-2025-27556

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack v...

CVE-2025-10838

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and...

PT-2025-39378

Name of the Vulnerable Software and Affected Versions dref version 0.1.2 Description A prototype pollution issue exists in the lib.set function. This allows attackers to potentially cause a Denial of Service DoS by providing a specially crafted payload. The issue involves manipulating the prototy...

dref security vulnerabilities

dref is a DNS rebinding exploit framework open-sourced by F-Secure LABS. A security vulnerability exists in dref version 0.1.2, which stems from prototype contamination in the lib.set function and could lead to a denial-of-service attack...

CVE-2025-26278

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2025-26278

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2025-26278

The dref (NPM) package, specifically version v0.1.2 , is vulnerable to Prototype Pollution in its lib.set function. An attacker can provide a crafted payload to inject malicious properties into the Object.prototype, which are then inherited by all JavaScript objects. This can result in a Denial o...

Linux Distros Unpatched Vulnerability : CVE-2025-39867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftsetpipapo: fix null deref for empty set Blamed commit broke the check for a null scratch map: - if unlikely!m || !rawcpuptrm-scratch + if...

Configure a Proper Value for MaxAuthTries

MaxAuthTries indicates the maximum number of user authentication failures allowed in a single connection. If the number of user authentication failures exceeds the value, the connection is automatically disconnected. You are advised to set this field to a value less than or equal to 3. If this...