24700 matches found
Envoy forwards early CONNECT data in TCP proxy mode
Summary Forwarding of early CONNECT data in TCP proxy mode. Details Per RFC 7231-4.3.6 the sender of CONNECT and all inbound proxies switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxie...
GHSA-7X2J-2674-FJ95
creationtimestamp| type| source ---|---|--- 2025-12-05 17:00:11+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115668026058293996...
GHSA-HQ6C-R898-FGF2
creationtimestamp| type| source ---|---|--- 2025-12-05 16:53:00+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667997784638676...
GHSA-495W-CQV6-WR59
creationtimestamp| type| source ---|---|--- 2025-12-05 16:43:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667959131777282...
GHSA-QCW2-P26M-9GC5
creationtimestamp| type| source ---|---|--- 2025-12-05 16:43:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667959131777282...
GHSA-2XPW-W6GG-JR37
creationtimestamp| type| source ---|---|--- 2025-12-05 16:24:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667885290569342 2025-12-05 17:54:47+00:00| seen| https://seclists.org/oss-sec/2025/q4/250...
CVE-2025-14092
creationtimestamp| type| source ---|---|--- 2025-12-05 16:13:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667841253149237...
CVE-2025-55184
creationtimestamp| type| source ---|---|--- 2025-12-05 13:54:28+00:00| seen| https://vulnerability.circl.lu/bundle/6739b288-995a-4f1a-9f03-5d1ced3a8fbd 2025-12-11 20:51:04+00:00| seen| https://bsky.app/profile/react.dev/post/3m7qhaqdxuc2v 2025-12-11 20:51:04+00:00| seen|...
CVE-2025-10055
creationtimestamp| type| source ---|---|--- 2025-12-05 12:53:27+00:00| seen| https://gist.github.com/Darkcrai86/8b7d6f7f145721ec619c193e6a52f0b9...
CERTFR-2025-ALE-014
creationtimestamp| type| source ---|---|--- 2025-12-05 10:25:20+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115666473271240932...
CVE-2025-12355
The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...
CVE-2025-12355
CVE-2025-12355 refers to the Payaza WordPress plugin. The vulnerability is a missing capability check on the AJAX endpoint wp_ajax_nopriv_update_order_status, allowing unauthenticated attackers to modify order statuses. Affected versions are all up to and including 0.3.8. The public reports descr...
CVE-2025-12355 Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update
The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...
CVE-2025-66561
creationtimestamp| type| source ---|---|--- 2025-12-05 02:35:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m77h7ulugt2s...
WordPress plugin Payaza 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...
ZSPACE Q2C 命令注入漏洞
ZSPACE Q2C is a private cloud storage device from China's Extreme Space ZSPACE. A command injection vulnerability exists in ZSPACE Q2C NAS 1.1.0210050 and earlier versions, which stems from incorrect manipulation of the parameter safedir in the file /v2/file/safe/status, which could lead to a...
PT-2025-49317
Name of the Vulnerable Software and Affected Versions ZSPACE Q2C NAS versions through 1.1.0210050 Description A security flaw exists in ZSPACE Q2C NAS that allows for remote command injection. The issue is located within the zfilev2 api.SafeStatus function of the HTTP POST Request Handler...
CVE-2024-58277
creationtimestamp| type| source ---|---|--- 2025-12-04 23:18:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m774aibsn52s...
WordPress Payaza plugin <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update vulnerability
Missing Authorization to Unauthenticated Order Status Update vulnerability discovered by Legion Hunter in WordPress Plugin Payaza versions = 0.3.8...