The vulnerability of the CFileNameAttr::Parse() function in the NtfsHandler.cpp file of the 7-Zip archive tool allows a hacker to load arbitrary files and gain unauthorized access to protected information.

The vulnerability of the CFileNameAttr::Parse function in the NtfsHandler.cpp file of the 7-Zip archive processor is related to the occurrence of operations outside the buffer in memory, due to incorrect processing of two-byte elements in the NTFS file system. Exploiting this vulnerability allows...

USN-7157-3 php7.0 vulnerabilities

USN-7157-1 fixed vulnerabilities in PHP versions 7.4, 8.1, and 8.3. This update provides the corresponding updates for PHP version 7.0. Original advisory details: It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters. An attacker...

RHSA-2025:0692 Red Hat Security Advisory: redis:7 security update

Bulletin has no description...

SUSE CVE-2024-43445

A vulnerability exists in OTRS and OTRS Community Edition that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. This issue affects:...

SUSE CVE-2025-24389

Certain errors of the upstream libraries will insert sensitive information in the OTRS or OTRS Community Edition log mechanism and mails send to the system administrator. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS Community Edition: 6.0.x Products based on the OTRS...

CVE-2024-57519

An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogsdbiauthinfo function in lib/dbi/subscription.c file...

HPESBNW04775 rev.1 - HPE Aruba Networking Fabric Composer Multiple Vulnerabilities

Potential Security Impact: Local: Cross-Site Scripting XSS; Remote: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Fabric Composer : Please refer to the Description section of this security bulletin. Affected Products HPE Aruba Networking Fabric...

WordPress Social Share Buttons for WordPress plugin <= 2.7 - Unauthenticated Image Upload & Path Traversal vulnerability

Unauthenticated Image Upload & Path Traversal vulnerability discovered by Bob Matyas in WordPress Plugin Social Share Buttons for WordPress versions = 2.7...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

CVE-2025-23197

creationtimestamp| type| source ---|---|--- 2025-01-27 17:29:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113901498998569976 2025-01-27 18:16:09+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqkd37gqx27 2025-01-27 20:11:17+00:00| seen|...

CVE-2025-24680

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in WpMultiStoreLocator WP Multi Store Locator allows Reflected XSS. This issue affects WP Multi Store Locator: from n/a through 2.4.7...

UBUNTU-CVE-2025-24814

Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that 1 use the "FileSystemConfigSetService" component the default in "standalone" or "user-managed" mode, and 2 are running without authentication and authorization are vulnerable to a sort...

CVE-2024-13117

creationtimestamp| type| source ---|---|--- 2025-01-27 06:16:18+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgpc3uiqv62i 2025-01-27 06:49:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lgpdxjnup72q 2025-01-27 06:51:46+00:00| seen|...

CVE-2024-12436

creationtimestamp| type| source ---|---|--- 2025-01-27 06:02:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113898798720190607 2025-01-27 06:06:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113898815688137258 2025-01-27 06:15:49+00:00| seen|...

WordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin WP Multistore Locator versions = 2.4.7...

PT-2025-3358 · Baidu · Haokan Video

Name of the Vulnerable Software and Affected Versions: Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS version 7.70.0 Description: The issue allows attackers to access sensitive user information via supplying a crafted link. Recommendations: For version 7.70.0, consider avoiding...

frozen 代码问题漏洞

frozen is an open source JSON parser and generator for C/C++ from Cesanta Software. A code issue exists in frozen versions prior to 1.7, which is caused by a null pointer dereference. An attacker exploiting this vulnerability could trigger a crash of a component embedded in the library by providi...

PT-2025-5354 · Unknown +1 · Otrs Community Edition +1

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 2024.X OTRS Community Edition version 6.0.x Description: Certain errors of the upstream libraries will insert sensitive information in the log mechanism and mails sent to the system administrator. Products based on...

WordPress plugin The Events Calendar 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

PT-2025-4004 · Cesanta · Cesanta Frozen

Name of the Vulnerable Software and Affected Versions: Cesanta Frozen versions less than 1.7 Description: An Allocation of Resources Without Limits or Throttling issue allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input...