12715 matches found
CVE-2025-25204 `gh attestation verify` returns incorrect exit code during verification if no attestations are present
gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...
CVE-2023-34478
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha...
CVE-2024-32113
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue...
RHSA-2025:1433 Red Hat Security Advisory: kpatch-patch-5_14_0-503_15_1 security update
Bulletin has no description...
OPENSUSE-SU-2025:0059-1 Security update for chromium
This update for chromium fixes the following issues: Chromium 133.0.6943.98 boo1237121: - CVE-2025-0995: Use after free in V8 - CVE-2025-0996: Inappropriate implementation in Browser UI - CVE-2025-0997: Use after free in Navigation - CVE-2025-0998: Out of bounds memory access in V8...
CVE-2024-34215
TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function...
acmailer CGI and acmailer DB vulnerable to OS command injection
Overview acmailer CGI and acmailer DB provided by Extra Innovation Inc. contain an OS command injection vulnerability CWE-78. Extra Innovation Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Extra Innovation Inc. coordinated under the...
PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks
Threat actors who were behind the exploitation of a zero-day vulnerability in BeyondTrust Privileged Remote Access PRA and Remote Support RS products in December 2024 likely also exploited a previously unknown SQL injection flaw in PostgreSQL, according to findings from Rapid7. The vulnerability,...
CVE-2024-36070
tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. An update is also available for the 2022.11 series...
PT-2025-6724
Name of the Vulnerable Software and Affected Versions Apache EventMesh versions prior to 1.11.0 Description The issue concerns the deserialization of untrusted data at the eventmesh-meta-raft plugin module in Apache EventMesh, allowing attackers to send controlled messages and execute remote code...
PT-2025-7238 · Strongkey · Strongkey Fido Server
Name of the Vulnerable Software and Affected Versions: StrongKey FIDO Server versions prior to 4.15.1 Description: The issue arises when the StrongKey FIDO Server treats a non-discoverable namedcredential flow as a discoverable transaction. This can potentially lead to security risks. However,...
JVN#96957439: acmailer CGI and acmailer DB vulnerable to OS command injection
acmailer CGI and acmailer DB provided by Extra Innovation Inc. contain an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed by an attacker. Solution Update the software Update the software to the latest version according to the information provided by the...
CGA-CJ5V-W8VV-W9JJ
Bulletin has no description...
CVE-2025-24900
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to...
RHSA-2025:1372 Red Hat Security Advisory: container-tools:rhel8 security update
Bulletin has no description...
Zimbra Collaboration Server 9.0.x < 9.0.0 Patch 43, 10.0.x < 10.0.12, 10.1.x < 10.1.4 SSRF
An issue was discovered in Zimbra Collaboration ZCS. An SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints. Note that Nessus has not tested for this...
PT-2025-6873
Name of the Vulnerable Software and Affected Versions Fedora Linux kernel versions 6.12 through 6.12.13 Description A critical flaw in the Fedora Linux kernel disables Lockdown Mode by default, potentially allowing attackers to bypass Secure Boot protections. This issue affects systems starting a...
JVN#80527854: Multiple vulnerabilities in FileMegane
FileMegane provided by JIP InfoBridge Co., Ltd. contains multiple vulnerabilities listed below. Server-Side Request Forgery SSRF CWE-918 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L Base Score 7.2 CVE-2025-20075 Authentication Bypass by Spoofing（CWE-290） CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A...