155 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-113867
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies,...
Mozilla Thunderbird < 153.5.1
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which...
Mozilla Thunderbird < 153.5.1
The version of Thunderbird installed on the remote Windows host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was...
Mozilla Thunderbird < 158.0.1
The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory. - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was...
CVE-2026-113867
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
CVE-2026-113867 Stanza injection in XMPP chat
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
CVE-2026-113867
The Thunderbird chat feature with XMPP accounts is vulnerable to a stanza injection flaw. The root cause is the failure to escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests are echoed in automatic replies, a remote XMPP user can send a crafted r...
EUVD-2026-105294
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
CVE-2026-113867
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
Security Vulnerabilities fixed in Thunderbird 153.5.1 — Mozilla
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. Thunderbird did n...
abtranslate (>=0.1.28, <=0.2.0), allophant (1.0.0) +112 more potentially affected by CVE-2026-59974 via stanza (>=1.0.0, <=1.13.0)
stanza PYPI version =1.0.0, =0.1.28, =0.2.4, =1.0.1, =1.4.0, =1.4.0, =1.6.0, =1.9.6, =0.0.1, =1.0.1, =0.0.1, =1.0.0rc3, =0.1.0, =0.0.1, =0.0.3 and more Source cves: CVE-2026-59974 Source advisory: SNYK:PYTHON-STANZA-21692671...
Directory Traversal
Overview stanza is an A Python NLP Library for Many Human Languages, by the Stanford NLP Group Affected versions of this package are vulnerable to Directory Traversal via the unzip function in the resource extraction process. An attacker can overwrite files outside the intended directory and...
CVE-2026-59974
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...
CVE-2026-59974 Stanza: Zip Slip Path Traversal in Model/Resource Extraction
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...
CVE-2026-59974
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...
abtranslate (>=0.1.28, <=0.2.0), allophant (1.0.0) +112 more potentially affected by CVE-2026-59974 via stanza (>=1.0.0, <=1.13.0)
stanza PYPI version =1.0.0, =0.1.28, =0.2.4, =1.0.1, =1.4.0, =1.4.0, =1.6.0, =1.9.6, =0.0.1, =1.0.1, =0.0.1, =1.0.0rc3, =0.1.0, =0.0.1, =0.0.3 and more Source cves: CVE-2026-59974 Source advisory: MEND:CVE-2026-59974...
CVE-2026-59974 Stanza: Zip Slip Path Traversal in Model/Resource Extraction
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...
CVE-2026-59974 Stanza: Zip Slip Path Traversal in Model/Resource Extraction
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...
CVE-2026-59974
Stanza is a Stanford NLP Python library. Prior to 1.14.0 , the function stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths. The vulnerable extraction path is reachable through stan...
EUVD-2026-80864
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...