5841 matches found
OSV-2025-131 Heap-buffer-overflow in vips_foreign_save_heif_write_block
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=396460413 Crash type: Heap-buffer-overflow WRITE Crash state: vipsforeignsaveheifwriteblock wbufferwritethread vipsthreadsetwork...
SUSE CVE-2023-29545
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are...
SUSE CVE-2023-41835
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fi...
CVE-2024-33819
Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...
CVE-2025-1114
A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack...
PT-2025-6011 · Unknown · Newbee-Mall
Name of the Vulnerable Software and Affected Versions: newbee-mall version 1.0 Description: A problematic issue has been found in newbee-mall. The save function of the /admin/categories/save API endpoint in the Add Category Page component is affected. The manipulation of the categoryName argument...
newbee-mall 代码注入漏洞
newbee-mall is a newbee open source e-commerce system . Newbee-mall 1.0 version of the code injection vulnerability exists , the vulnerability stems from the component Add Category Page file /admin/categories/save function save the parameter categoryName will lead to cross-site scripting attacks...
CVE-2024-13841: Authorization Bypass Through User-Controlled Key
The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This...
PT-2025-5904
Name of the Vulnerable Software and Affected Versions The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress versions up to, and including, 1.0.0 Description The issue allows authenticated attackers with Contributor-level access and above to extract...
CVE-2025-24671
Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...
CVE-2025-20029
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-20029
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2024-3435
A path traversal vulnerability exists in the 'savesettings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'applysettings' function, allowing an...
CVE-2024-29959
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save...
CVE-2025-24964
Vitest CVE-2025-24964 is a remotely exploitable CSWSH (Cross-site WebSocket hijacking) vulnerability in the Vitest API server when api is enabled. The WebSocket server did not validate Origin or enforce authorization, exposing saveTestFile (edits test files) and rerun (executes tests) APIs. An at...
CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...
The vulnerability of the /admin/tag/save file in the Jfinal CMS system allows a attacker to perform a CSRF attack.
The vulnerability of the /admin/tag/save file in the Jfinal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...
WordPress ThemeREX Addons plugin <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data vulnerability
Unauthenticated Arbitrary File Upload in trxaddonsuploadssavedata vulnerability discovered by Tonn in WordPress Plugin ThemeREX Addons versions = 2.32.3...
