12390 matches found
Esri ArcGIS Server 跨站脚本漏洞
Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...
WordPress Simple:Press plugin <= 6.10.11 - Cross-Site Request Forgery to Unauthorized Post Editing vulnerability
Cross-Site Request Forgery to Unauthorized Post Editing vulnerability discovered by 20kilograma in WordPress Plugin Simple:Press versions = 6.10.12...
DEBIAN-CVE-2024-49570
In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TPprintk UAF The commit afd2627f727b "tracing: Check "%s" dereference via the field and not the TPprintk format" exposes potential UAFs in the xebomove trace event. Fix those by avoiding...
UBUNTU-CVE-2025-25192
GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...
CVE-2025-25192 GLPI allows unauthorized access to debug mode
GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...
UBUNTU-CVE-2025-23024
GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...
UBUNTU-CVE-2025-21627
GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contai...
February 25, 2025—KB5052077 (OS Build 19045.5555) Preview
None None...
PT-2025-7836 · Wpsoul · Wpsoul Greenshift
Name of the Vulnerable Software and Affected Versions: wpsoul Greenshift versions through 10.8 Description: The issue affects wpsoul Greenshift, allowing Stored XSS due to improper neutralization of input during web page generation. Recommendations: For versions through 10.8, update to a version...
USN-7285-1: nginx vulnerability
It was discovered that nginx incorrectly handled when multiple server blocks are configured to share the same IP address and port. An attacker could use this issue to use session resumption to bypass client certificate authentication requirements on these servers. This issue only affected Ubuntu...
CVE-2025-1412 Session Persistence After User-to-Bot Conversion
Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...
WordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis Patchstack Alliance in WordPress Plugin Greenshift versions = 10.8...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization of QPY files containing malformed symengine serialization streams. An attacker can terminate the process by sending a crafted QPY file. This is only exploitable if symengine =...
Medium: squid
Issue Overview: Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks...
Extreme Networks IQ Engine 安全漏洞
Extreme Networks IQ Engine is an engine by Extreme Networks, Inc. A security vulnerability exists in Extreme Networks IQ Engine versions prior to 10.6r1a and versions prior to 10.6r4 through 10.6r5, which originates from a buffer overflow in the ahwebui service...
CVE-2025-0796
The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...
JSONPath Plus 安全漏洞
JSONPath Plus is an open source library for JSONPath Plus. A security vulnerability exists in JSONPath Plus versions prior to 10.3.0, which stems from the presence of improper input sanitization and an insecure default mode that can lead to remote code execution...
PT-2025-6891 · Pix · Pix Software Vivaz
Name of the Vulnerable Software and Affected Versions: Pix Software Vivaz version 6.0.10 Description: A problematic vulnerability was found in Pix Software Vivaz, affecting unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has be...
SUSE CVE-2024-54682
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
