AZL-56640 CVE-2025-1147 affecting package binutils for versions less than 2.37-20

A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function sanitizer::internalstrlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched...

WordPress WP Foodbakery plugin <= 4.7 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin FoodBakery versions = 4.7...

WordPress Super Store Finder plugin <= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting vulnerability

Unauthenticated SQL Injection to Stored Cross-Site Scripting vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Plugin Super Store Finder versions = 7.0...

WordPress plugin WP Foodbakery 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin WP Foodbakery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin.... A cross-site...

PT-2025-6083 · WordPress · Wp Foodbakery

Name of the Vulnerable Software and Affected Versions: WP Foodbakery plugin for WordPress versions up to and including 4.7 Description: The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the upload publisher profile image...

CVE-2024-56921

An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmmstateexception function upon receipt of the NausfUEAuthenticationAuthenticate response...

CVE-2024-52884

An issue was discovered in AudioCodes Mediant Session Border Controller SBC before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports INI is able to decrypt the passwords...

PT-2025-5996 · Puppet · Puppet Agent

Name of the Vulnerable Software and Affected Versions: Puppet Agent versions prior to 7.4.0 Description: The issue arises from the utilization of a module that presents a security risk by allowing the deserialization of untrusted or user-supplied data. Recommendations: For Puppet Agent versions...

WordPress plugin Fyrebox Quizzes 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

CVE-2021-22275

Buffer Overflow vulnerability in B Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service...

Tiny File Manager 跨站脚本漏洞

Tiny File Manager is a web-based open source file manager from the individual developer Prasath Mani. A security vulnerability exists in Tiny File Manager version v2.4.7 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code by injecting a specially crafted...

CVE-2022-36076

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...

CVE-2022-24851

LDAP Account Manager LAM is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS...

CVE-2022-24897

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...

CVE-2022-2218

Cross-site Scripting XSS - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0...

CVE-2020-2718

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0-12.4.0 and 14.0.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-2510

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via OracleNet to compromise Core RDBMS. Successful attack...

CVE-2024-43370

gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...

CVE-2024-21075

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim Line LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management...