2334 matches found
CVE-2024-1045
creationtimestamp| type| source ---|---|--- 2025-11-21 18:31:26+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3m65w4mkfek2q...
Denial-of-service (DoS)
@plone/volto is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of a specific URL request, which allows an attacker to crash the NodeJS server component by simply visiting that crafted URL...
CVE-2025-65100
creationtimestamp| type| source ---|---|--- 2025-11-19 21:20:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5z6myvjpa2s...
CVE-2025-64765
Astro (web framework) vulnerability CVE-2025-64765 and related advisories describe a path normalization mismatch: Astro uses decodeURI for routing, while middleware reads context.url.pathname without the same normalization. This permits bypassing path-based authentication by double-encoded URLs (...
CVE-2024-8528
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...
Apache Causeway vulnerable to deserialization in Java
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
PT-2025-47455
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...
Apache Causeway 安全漏洞
Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...
MAL-2025-191686 Malicious code in aws-enumerateiam (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c108190780b32337fdce8748948935ac4229f0236710653f363b80a95dfbcd17 Before creating the boto3 client, package exfiltrates user's credentials. In this version, the exfiltrating is masked as connecting to an AWS component. The UR...
CVE-2025-13080
creationtimestamp| type| source ---|---|--- 2025-11-18 17:17:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5wamccvly2a...
CVE-2025-55179
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...
CVE-2025-13230
creationtimestamp| type| source ---|---|--- 2025-11-18 01:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5ulipeouy2u 2025-11-18 07:51:18+00:00| seen| https://gist.github.com/Darkcrai86/3b9993543ef16c5ecbb901ec6a77f1eb 2025-12-09 08:41:36+00:00| seen|...
TOTOLINK A720R Command Injection Vulnerability (CNVD-2025-29710)
TOTOLINK A720R is a wireless router from China's Gion Electronics TOTOLINK with dual-band Wi-Fi capabilities, focusing on high-speed internet and signal coverage. The TOTOLINK A720R suffers from a command injection vulnerability that stems from the unvalidated magicid and url parameters in the...
SolarWinds Observability Self-Hosted 跨站脚本漏洞
SolarWinds Observability Self-Hosted is an observation platform from SolarWinds, Inc. A cross-site scripting vulnerability exists in SolarWinds Observability Self-Hosted, which stems from a cross-site scripting vulnerability in a user-created URL field that could lead to an attack by a...
CVE-2024-44660
creationtimestamp| type| source ---|---|--- 2025-11-17 21:30:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5u6b5lmsi2s...
CVE-2025-31649
creationtimestamp| type| source ---|---|--- 2025-11-17 14:30:05+00:00| seen| https://infosec.place/objects/c4fb9493-0d44-4262-9514-bf83eeef89f5 2025-11-18 01:11:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5uklz5skg2q...
EUVD-2025-197664
Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques...
CVE-2025-60679
creationtimestamp| type| source ---|---|--- 2025-11-13 19:38:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115544079480228162 2025-11-13 21:05:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5k2yhtll42u...