17029 matches found
BELL-CVE-2025-38245
Bulletin has no description...
BELL-CVE-2025-38249
Bulletin has no description...
BELL-CVE-2025-38250
Bulletin has no description...
BELL-CVE-2025-27613
Bulletin has no description...
Timing Attack
parisneo/lollms is vulnerable to timing attack. The vulnerability is due to the use of Python's default string equality operator for password comparison, which causes variable response times based on matching characters — allowing an attacker to enumerate valid usernames and incrementally guess...
PT-2025-28975
Name of the Vulnerable Software and Affected Versions: Dradis versions prior to 4.11.0 Description: The Dradis Output Console displays a job queue that may reveal information pertaining to jobs belonging to other users. Recommendations: Update to version 4.11.0 or later...
IBM Analytics Content Hub 代码问题漏洞
IBM Analytics Content Hub is a clean streaming experience from International Business Machines IBM that visualizes relevant analytics by extracting content from IBM and other analytics providers. A code issue vulnerability exists in IBM Analytics Content Hub versions 2.0, 2.1, 2.2, and 2.3 that...
PT-2025-29150
Name of the Vulnerable Software and Affected Versions: cpp-httplib versions prior to 0.20.1 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Versions prior to 0.20.1 do not have a limit for a unique line, which allows an attacker to allocate memory...
Allworx System Software 跨站脚本漏洞
Allworx System Software is a communication software platform from Allworx Corporation. A security vulnerability exists in Allworx System Software version v9.1.9.12, which stems from improper handling of the SessionID parameter in the Admin Login page, which could lead to a cross-site scripting...
CVE-2023-50458
In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs...
WordPress Sharable Password Protected Posts plugin < 1.1.1 - Unauthenticated Password Protect Post Access vulnerability
Unauthenticated Password Protect Post Access vulnerability discovered by Pierre Rudloff in WordPress Plugin Sharable Password Protected Posts versions 1.1.1...
Command Injection
mcp-server-kubernetes is vulnerable to Command Injection. The vulnerability is due to unsanitized command execution due to direct use of unvalidated user input in childprocess.execSync, allowing injection of shell metacharacters and execution of arbitrary system commands...
GHSA-JMRV-RXGR-PHVR Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form
Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...
Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check
Jenkins Git Parameter Plugin implements a choice build parameter that lists the configured Git SCM’s branches, tags, pull requests, and revisions. Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered...
Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log. Credentials Binding Plugin 687.689.v1af775332fc9 rethrows exceptions that contain credentials,...
GHSA-6XPM-GGF7-WC3P mcp-remote exposed to OS command injection via untrusted MCP server connections
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...
BELL-CVE-2025-48386
Bulletin has no description...
BELL-CVE-2025-38237
Bulletin has no description...