13092 matches found
BIT-PHP-MIN-2020-7059 OOB read in php_strip_tags_ex
When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash...
BIT-PHP-MIN-2020-7068 Use of freed hash key in the phar_parse_zipfile function
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure...
BIT-PHP-MIN-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong dat...
BIT-PHP-MIN-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs
In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...
BIT-PHP-MIN-2024-2757 PHP mb_encode_mimeheader runs endlessly for some inputs
In PHP 8.3. before 8.3.5, function mbencodemimeheader runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function...
BIT-PHP-MIN-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...
CGA-HG2R-6CXF-J94F
Bulletin has no description...
CVE-2025-21171 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CVE-2024-12085
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Mitigation Seei...
MAL-2025-2935 Malicious code in amzn-aws-glue-ml-libs-python (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e5986d73558862130dbb1317c6a92532786ec34f23d4d88c8fd6273198c5ce45 This is a couple of packages with names appearing to be a library for an AWS or other service. Their only behaviour is to call home on installation or import -...
CGA-C9JR-M4JG-Q69C
Bulletin has no description...
RHSA-2025:0284 Red Hat Security Advisory: thunderbird security update
Bulletin has no description...
RHSA-2025:0281 Red Hat Security Advisory: thunderbird security update
Bulletin has no description...
MAL-2025-103 Malicious code in testin-elengosee (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec5deac0188f700e1537b6812c80b7dafdc502d35714eb1c32cc371115dfeb67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-92 Malicious code in inspector-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de7dcf1a1dc869f5887ce7985e9cd00928aa23e5b231df8bc32f1b127b51c33b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CGA-4JH7-MJVV-47GG
Bulletin has no description...
CGA-F2X8-R4WQ-228F
Bulletin has no description...
MAL-2025-76 Malicious code in mlb-site-core (npm)
This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9de998c89065e54ad576039f907182866e20268fdbabf834365503931267443d Any computer that has this package install...