8614 matches found
RHEL 8 : kernel (RHSA-2025:22072)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22072 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ALSA: usb-audio: Validate UAC...
CVE-2025-54341
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values...
CVE-2025-54341
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values...
libssh: Incorrect Return Code Handling in ssh_kdf() in libssh
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...
EUVD-2025-198810
Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...
CVE-2025-12972 CVE-2025-12972
Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...
CVE-2025-12972 CVE-2025-12972
Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...
CVE-2025-12972 CVE-2025-12972
Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...
CVE-2025-54341
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values...
CVE-2025-54341
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values...
CVE-2025-54341
A security vulnerability exists in the Application Server component of Desktop Alert PingAlert versions 6.1.0.11 through 6.1.1.2 . The root cause is the presence of hard-coded configuration values , which is categorized as CWE-798 (Use of Hard-coded Credentials). The impact of this vulnerability ...
CVE-2025-11936
Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to...
CVE-2025-13470: Use of Insufficiently Random Values
In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...
Opto 22 groov RIO operating system command injection vulnerability
The Opto 22 groov RIO is an industrial remote I/O module from Opto 22 USA. An operating system command injection vulnerability exists in the Opto 22 groov RIO that stems from the unsafe use of header value build commands, which could lead to remote code execution...
TencentOS Server 4: golang (TSSA-2025:0328)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0328 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
Snipe-IT security vulnerabilities
Snipe-IT is an open source IT asset/license management system from Grokability Open Source. A security vulnerability exists in Snipe-IT version v8.3.4, which stems from the presence of reflective cross-site scripting in the CSV import workflow, which could lead to the execution of arbitrary...
WordPress CSV to SortTable plugin cross-site scripting vulnerability
WordPress CSV to SortTable plugin is WordPress plugin for converting CSV files to interactive sorting tables. The WordPress CSV to SortTable plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data,...
CVE-2025-64027
The IT asset management system Snipe-IT v8.3.4 (build 20218) is vulnerable to a reflected cross-site scripting (XSS) flaw in the CSV Import workflow. The root cause is the lack of sanitization for the progress_message value, which the application renders as raw HTML in the admin interface. An att...
EUVD-2025-198183
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values...
GHSA-WRWG-2HG8-V723 Astro vulnerable to reflected XSS via the server islands feature
Summary After some research it appears that it is possible to obtain a reflected XSS when the server islands feature is used in the targeted application, regardless of what was intended by the component templates. Details Server islands run in their own isolated context outside of the page reques...