15197 matches found
CVE-2025-64456
CVE-2025-64456 affects JetBrains ReSharper versions prior to 2025.2.4 . The issue stems from missing signature verification in the DPA Collector , allowing local privilege escalation . Affected software is ReSharper (a Visual Studio extension for .NET). The vulnerability impact is described as lo...
PT-2025-46148
Name of the Vulnerable Software and Affected Versions JetBrains ReSharper versions prior to 2025.2.4 Description A missing signature verification in the DPA Collector component allows for local privilege escalation. The DPA Collector is likely responsible for collecting or transmitting diagnostic...
Important: amazon-ecr-credential-helper
Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...
Important: amazon-ecr-credential-helper
Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...
JetBrains ReSharper 数据伪造问题漏洞
JetBrains ReSharper is a Visual Studio extension for .NET development from the Czech company JetBrains. The program is mainly used for code quality analysis, code error alerts and other functions. A data forgery issue vulnerability exists in JetBrains ReSharper versions prior to 2025.2.4, which...
Important: amazon-ecr-credential-helper
Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...
SUSE CVE-2025-62375
go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...
CVE-2025-58188
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Mitigation Mitigation for this issue is either not available or the...
CVE-2025-46404
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability. Mitigation Mitigation for thi...
BIT-GOLANG-2025-58188 Panic when validating certificates with DSA public keys in crypto/x509
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains...
Updated microcode packages fix security vulnerability
AMD CPU Microcode Signature Verification Vulnerability. CVE-2024-36347...
MGASA-2025-0258 Updated microcode packages fix security vulnerability
AMD CPU Microcode Signature Verification Vulnerability. CVE-2024-36347...
AZL-69854 CVE-2025-46404 affecting package lasso 2.8.0-1
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
AZL-69841 CVE-2025-46404 affecting package lasso for versions less than 2.9.0-1
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
CVE-2025-46404
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
CVE-2025-46404
CVE-2025-46404 affects the lasso library’s SAML handling (lasso_provider_verify_saml_signature) and can cause denial of service via malformed SAML inputs. Connected advisories confirm multiple distributions issuing fixes: Debian DLA-4397-1 fixes lasso to 2.6.1-3+deb11u1; openSUSE openSUSE-SU-2025...
CVE-2025-46404
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
CVE-2025-46404
A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
CVE-2025-8871
CVE-2025-8871: Everest Forms Pro for WordPress (≤1.9.7) is vulnerable to unauthenticated PHP Object Injection via PHAR deserialization in mime_content_type(). Attackers can inject a PHP object when a form with a non-required signature field and image upload is present. No POP chain is in the core...
CVE-2025-8871 Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...