MetaCPAN String::Compare::ConstantTime security vulnerability

MetaCPAN String::Compare::ConstantTime is a component of the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN String::Compare::ConstantTime version 0.321 and earlier, which stems from a timing attack that could disclose the length of a secret string...

PT-2025-13421 · Unknown +1 · String::Compare::Constanttime +1

Name of the Vulnerable Software and Affected Versions: String::Compare::ConstantTime versions prior to 0.322 Description: The issue allows an attacker to guess the length of a secret string through timing attacks. According to the documentation, if the lengths of the strings are different, the si...

CVE-2024-13939: Observable Timing Discrepancy

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...

jinja2: Jinja sandbox breakout through attr filter selecting format method

A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content o...

UBUNTU-CVE-2025-31178

A flaw was found in gnuplot. The GetAnnotateString function may lead to a segmentation fault and cause a system crash...

Denial Of Service (DoS)

ai.h2o, h2o-core is vulnerable to Denial Of Service DoS. The vulnerability is due to the /3/Parse endpoint constructing a regular expression from a user-specified string, which is then applied to another user-specified string, allowing an attacker to send multiple simultaneous requests and exhaus...

PT-2025-13246

Name of the Vulnerable Software and Affected Versions libming version 0.4.8 Description The issue is related to an out-of-memory error in the parseABC STRING INFO function, which allows attackers to cause a Denial of Service DoS due to allocator exhaustion. Recommendations For libming version...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2018-17336 DESCRIPTION: UDisks could allow a local attacker to obtain sensitive information, caused by a format string vulnerability in udiskslog in udiskslogging.c. By using a...

CVE-2025-30742

httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' character...

CVE-2025-30742

The CVE-2025-30742 entry concerns atophttpd 2.8.0. Affected component: httpd.c. Description: an off-by-one error causes an out-of-bounds read when processing a 1024-character request string that would not terminate with a final NUL character. Impact is a partial/low-severity in the NVD metrics (a...

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

...

PT-2025-12792

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A critical vulnerability was found in Open Asset Import Library Assimp, affecting the function AI MD5 PARSE STRING IN QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the...

CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

CVE-2025-30208

Vite, a frontend development tool, contains an arbitrary file read vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. The flaw exists because trailing separators like ? are removed during request processing but are not accounted for in query string regexes. Attackers can...

CVE-2025-30208 Vite bypasses server.fs.deny when using `?raw??`

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

CVE-2025-30208 Vite bypasses server.fs.deny when using `?raw??`

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. "@fs" denies access to files outside of Vite serving allow list. Adding "?raw??" or "?import&raw??" to the URL bypasses this limitation and returns the file content...

CVE-2025-30208: Exposure of Sensitive Information to an Unauthorized Actor

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

CVE-2025-30348

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string with relocation of later data...

CVE-2024-8556

A stored cross-site scripting XSS vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string run ID is appended and rendered as HTML. This allows ...