818 matches found
Linux Distros Unpatched Vulnerability : CVE-2019-15605
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Note that Nessus relies on...
Linux Distros Unpatched Vulnerability : CVE-2017-18869
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via...
CVE-2025-49432 WordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Video Player: from n/a through = 10.1...
MAL-2025-15499 Malicious code in baseui-v10 (npm)
The package baseui-v10 was found to contain malicious code...
Malicious code in search-result (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6ddb1c5d5505a20da7fa64201ed64cc4b487447debb5dfac4a7d1398b93bcb1a The OpenSSF Package Analysis project identified 'search-result' @ 10.11.0 npm as malicious. It is considered malicious because: - The package...
MAL-2025-6937 Malicious code in jenkins-trigger-action (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fedbad1242e09329c414a95c493ce62c39c15cad4472ef5fc4a8b9b836834fb4 The OpenSSF Package Analysis project identified...
Linux Distros Unpatched Vulnerability : CVE-2025-54567
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hw/pci/pciesriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. CVE-2025-54567 Note that Nessus relies on...
WordPress plugin YouTube Embed 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2025-43483
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has addressed the issue in the latest software update...
CVE-2025-43020
A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update...
HP Poly Clariti Manager devices 操作系统命令注入漏洞
HP Poly Clariti Manager devices is a device management system from Hewlett-Packard HP in the United States. An operating system command injection vulnerability exists in HP Poly Clariti Manager devices versions prior to 10.12.2, which originates from a privileged user being able to submit arbitra...
CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...
WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability
Server Side Request Forgery SSRF Vulnerability discovered by Anhchangmutrang in WordPress Plugin Ultimate Video Player versions = 10.1...
Malicious code in defectdojosw (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93d614c0d808786b112774fdec4eb2b8afecef6ec8de82e4945bdc644e5023c4 The OpenSSF Package Analysis project identified 'defectdojosw' @ 10.1.0 npm as malicious. It is considered malicious because: - The package...
CVE-2025-52486
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been...
IBM Security Verify Access Docker和IBM Security Verify Access Appliance 安全漏洞
IBM Security Verify Access Docker and IBM Security Verify Access Appliance are both products of International Business Machines IBM.IBM Security Verify Access Docker is a software that can be used to configure a Docker IBM Security Verify Access Docker is a service that can be used to configure a...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.2-ifix2 Vulnerability Details CVEID:CVE-2019-12900 DESCRIPTION: BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CWE:CWE-787: Out-of-bounds Write CVSS...
BIT-MARIADB-MIN-2022-27457
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component mymbwclatin1 at /strings/ctype-latin1.c...