The vulnerability of the CoreMedia component in operating systems such as macOS, tvOS, iPadOS, iOS, visionOS, and watchOS allows attackers to execute arbitrary code or cause service interruptions.

The vulnerability of the CoreMedia component in operating systems such as macOS, tvOS, iPadOS, iOS, visionOS, and watchOS is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service interruptions...

CVE-2024-51447

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.2. The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to...

The vulnerability of the QRadar Advisor with Watson analytical security threat analysis tool lies in insufficient validation of incoming requests, allowing attackers to carry out SSRF attacks.

The vulnerability of the QRadar Advisor with Watson analytical security threat analysis tool is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

PT-2025-17457 · Flaskblog · Flaskblog

Name of the Vulnerable Software and Affected Versions: laskBlog version 2.6.1 Description: The issue allows attackers to bypass access controls and obtain all usernames by providing a specially crafted input. Recommendations: For laskBlog version 2.6.1, consider restricting access to sensitive us...

WordPress plugin Forminator Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the vnd.libreoffice.command module in the LibreOffice office software package allows a hacker to gain unauthorized access to protected information or cause service failures.

The vulnerability of the vnd.libreoffice.command component in the LibreOffice office software package is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service failures...

CVE-2024-11679

An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory...

The vulnerability of Websoft HCM’s automation software for HR processes stems from insufficient validation of input data, allowing attackers to execute the displayed HTML code.

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code by sending a specially crafted POST request...

Multi-Vendor BIOS Security Vulnerabilities (April 2025) - Lenovo Support US

No description provided...

Infinxt iEdge 100 安全漏洞

Infinxt iEdge 100 is a next-generation secure SD-WAN appliance for small and medium-sized branch offices from Infinxt. A security vulnerability exists in the Infinxt iEdge 100 version 2.1.32, which stems from improper validation of user input for the mtrIp parameter in the MTR function of the...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large-scale language models. A code issue vulnerability exists in FastChat version 0.2.36, which stems from insufficient validation of path parameters and could lead to a server-side request forgery...

The vulnerability of the set_add_routing function in the internet.cgi script of the Wavlink AC3000 (WL-WN533A8) router microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the setaddrouting function in the internet.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of packet tunneling protocols for IPv4-to-IPv6 and IPv6-to-IPv4 protocols arises from insufficient checks on the source of the communication channel. This allows attackers to execute attacks such as “spoofing of trusted objects”.

The vulnerability of IPv4-to-Ipv6 and IPv6-to-Ipv4 tunneling protocols is related to insufficient checks on the source of the communication channel. Exploiting this vulnerability allows a remote attacker to execute “host object substitution” attacks by sending a specially crafted packet with two ...

WordPress plugin Easy Form Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-17504 · WordPress · Ninja Forms

Name of the Vulnerable Software and Affected Versions: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress versions up to, and including, 3.8.22 Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an acti...

sigstore has insufficient validation of integration timestamp during verification

Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

The vulnerability of the JavaScript library for secure cleaning and protection of HTML code, DOMPurify, is related to deficiencies in the validation of input data containing XSS attack indicators. This vulnerability allows attackers to execute cross-site scripting attacks.

The vulnerability of the JavaScript library for secure cleaning and protection of HTML code, DOMPurify, is related to deficiencies in the validation of input data containing XSS attack indicators. Exploiting this vulnerability can allow a remote attacker to execute cross-site scripting attacks...

SuiteCRM SQL注入漏洞

SuiteCRM is an open source, enterprise-level customer relationship management CRM software. SuiteCRM suffers from a SQL injection vulnerability that is caused by insufficient validation of input values. An attacker can exploit the vulnerability to execute SQL commands, which in turn may be used t...

The vulnerability of the NuPoint Unified Messaging component of the Mitel MiCollab collaboration platform, related to insufficient validation of input data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the NuPoint Unified Messaging component of the Mitel MiCollab collaboration platform relates to the failure to implement measures to neutralize specific elements. Exploiting this vulnerability allows attackers to execute arbitrary commands...