17029 matches found
HTML Injection
starcitizentools/citizen-skin is vulnerable to HTML Injection. The vulnerability is due to improper handling and lack of sanitization of user-editable messages that are directly rendered as HTML, allows an attacker to inject arbitrary HTML into the DOM...
PT-2025-26213 · WordPress · Wpbakery Page Builder
Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder for WordPress versions up to, and including, 8.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Grid Builder feature due to insufficient input sanitization and output escaping on...
PT-2025-26247
Name of the Vulnerable Software and Affected Versions xataio Xata Agent versions up to 0.3.0 Description A path traversal issue has been identified, affecting the GET function of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to this issue...
WordPress Spark Multipurpose Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)
Software Spark Multipurpose Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-50030 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 093473ec2f16 Credits Peter Thaleikis Required privilege...
DLA-4222-1 activemq - security update
Bulletin has no description...
[ASA-202506-8] erlang: arbitrary file overwrite
Arch Linux Security Advisory ASA-202506-8 ========================================= Severity: Medium Date : 2025-06-19 CVE-ID : CVE-2025-4748 Package : erlang Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2900 Summary ======= The package erlang before versi...
ROS-20250619-15
A software vulnerability in the Grafana monitoring and surveillance platform is related to a vulnerability in the of the XY Chart plugin to DOM XSS. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code Grafana monitoring and surveillance platform...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Improper Resource Shutdown or Release in Eclipse Jetty (CVE-2024-13009)
Summary Eclipse Jetty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD. CVE-2024-13009 Vulnerability Details CVEID:CVE-2024-13009 DESCRIPTION: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. Thi...
Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
The Couchbase .NET SDK client library before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default...
MAL-2025-5403 Malicious code in epic-ue-saleforce-form (npm)
The package communicates with a domain associated with malicious activity...
BIT-NODE-MIN-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system.
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied...
GHSA-CRVV-6W6H-CV34 Grafana long dashboard title or panel name causes unresponsives
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher...
CVE-2022-50162
creationtimestamp| type| source ---|---|--- 2025-06-18 12:14:28+00:00| seen| https://bsky.app/profile/potato.software/post/3lruyd2lavo23...
WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Smart Notification versions = 10.3...
CVE-2022-49988
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2022-50209 meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
In the Linux kernel, the following vulnerability has been resolved: meson-mx-socinfo: Fix refcount leak in mesonmxsocinfoinit offindmatchingnode returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...
CVE-2022-50191 regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
In the Linux kernel, the following vulnerability has been resolved: regulator: of: Fix refcount leak bug in ofgetregulationconstraints We should call the ofnodeput for the reference returned by ofgetchildbyname which has increased the refcount...
CVE-2022-50106 powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
In the Linux kernel, the following vulnerability has been resolved: powerpc/cell/axonmsi: Fix refcount leak in setupmsimsgaddress ofgetnextparent returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput in the error path to avoid...
CVE-2022-49975 bpf: Don't redirect packets with invalid pkt_len
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't redirect packets with invalid pktlen Syzbot found an issue 1: fqcodeldrop try to drop a flow whitout any skbs, that is, the flow-head is null. The root cause, as the 2 says, is because that bpfprogtestrunskb run a bpf...