658 matches found
CVE-2024-58111
Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58107
CVE-2024-58107 describes a buffer overflow in Huawei HarmonyOS? codec module with impact to availability. Connected sources confirm HarmonyOS, codec module as the vulnerable component, and indicate network attack vector with low complexity, no user interaction, and high severity (CVSS v3.1). No c...
Important: Red Hat Security Advisory: libxslt security update
An update for libxslt is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
CVE-2025-30563
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in makong Tidekey tidekey allows Reflected XSS.This issue affects Tidekey: from n/a through = 1.1...
CVE-2025-1971
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'formdata' parameter. This makes it possible for authenticated attackers, with Administrator-level acces...
The vulnerability of the PCX Image development platform’s SDP code base allows attackers to trigger a service failure.
The vulnerability of the PCX Image development platform’s SDP is related to improper validation of the specified data type. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping...
Linux Distros Unpatched Vulnerability : CVE-2024-26979
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2024-26979 Note that Nessus relies on the presence of the packag...
Linux Distros Unpatched Vulnerability : CVE-2022-48868
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled wh...
Linux Distros Unpatched Vulnerability : CVE-2024-26804
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: iptunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in skbflowdissect+0x19d1/0x7a50...
CVE-2024-58050
Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confidentiality...
Linux Distros Unpatched Vulnerability : CVE-2017-17689
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The S/MIME specification allows a Cipher Block Chaining CBC malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL...
CVE-2025-23579
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitalzoomstudio DZS Ajaxer Lite dzs-ajaxer-lite-dynamic-page-load allows Stored XSS.This issue affects DZS Ajaxer Lite: from n/a through = 1.04...
GHSA-5QMP-9X47-92Q8 Rancher's SAML-based login via CLI can be denied by unauthenticated users
Impact A vulnerability has been identified within Rancher where it is possible for an unauthenticated user to list all CLI authentication tokens and delete them before the CLI is able to get the token value. This effectively prevents users from logging in via the CLI when using rancher token as t...
CVE-2022-49234
In the Linux kernel, the following vulnerability has been resolved: net: dsa: Avoid cross-chip syncing of VLAN filtering Changes to VLAN filtering are not applicable to cross-chip notifications. On a system like this: .-----. .-----. .-----. | sw1 +---+ sw2 +---+ sw3 | '-1-2-' '-1-2-' '-1-2-'...
Python 3.12 Documentation Cross Site Scripting
The official Python 3.12 documentation provides a code example that results in implementing insecure code susceptible to cross site scripting. Python's official documentation contains textbook example of insecure code XSS Date: 2025-02-18 Author: Georgi Guninski From the official Python 3.12...
CVE-2025-21106
Dell RecoverPoint for Virtual Machines (RPVM) 6.0.X is affected by a weak file system permissions vulnerability (CVE-2025-21106). The issue enables a low-privileged local attacker to access non-sensitive resources; no patch details are provided in the included documents. A temporary workaround fr...
CVE-2024-13556
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to...
ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)
Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...