Improper Neutralization

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Improper Neutralization via validateTOTP. An attacker can gain unauthorized access to protected resources by reusing a valid code within its validity period by...

Malicious Package

Overview loquru is a malicious package. This package contains a malicious code and uses "typosquatting" to bait unaware users to install it. The malicious loquru package pretends to be the popular loguru library. It hides malicious code within a string of whitespace, which is executed upon import...

CLSA-2025-1753131065 libsoup: Fix of 7 CVEs

CVE-2025-32050: fix overflow in appendparamquoted - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff - CVE-2025-32053: fix heap buffer overflow in snifffeedorhtml - CVE-2025-32907: soup-message-headers: correct merge of ranges - CVE-2025-46420: fix leak in...

CLSA-2025-1753124055 libsoup: Fix of 7 CVEs

CVE-2025-32050: fix overflow in appendparamquoted - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff - CVE-2025-32053: fix heap buffer overflow in snifffeedorhtml - CVE-2025-32907: soup-message-headers: correct merge of ranges - CVE-2025-46420: fix leak in...

libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

CVE-2023-23612

OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider IdP when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and...

CVE-2020-5890

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace...

The vulnerability of the skip_insight_whitespace() function in the GNOME graphical interface library libsoup allows a attacker to trigger a service failure.

The vulnerability of the skipinsightwhitespace function in the GNOME graphical interface library libsoup is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure by sending a specially crafted HTTP request...

Important: libsoup

Issue Overview: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. CVE-2025-2784 Affected Packages...

USN-7416-1 kamailio vulnerabilities

Stelios Tsampas discovered that Kamailio did not correctly handle certain memory operations, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. CVE-2016-2385...

SUSE CVE-2025-2784

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

AZL-59535 CVE-2025-2784 affecting package libsoup for versions less than 3.0.4-6

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

CVE-2025-2784

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

Regular Expression Denial Of Service (ReDoS)

@octokit/request-error is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing in the handling of HTTP request headers. Specifically, the regex used to process authorization headers fails to handle excessive whitespace...

Astra Linux – Vulnerability in Ruby 3.1

REXML is an XML toolkit for Ruby. The REXML gem before version 3.3.2 had some DoS vulnerabilities when parsing XML that contained many special characters, such as whitespace characters, , , and . The REXML gem versions 3.3.3 or later include patches to fix these vulnerabilities...

Browsershot 输入验证错误漏洞

Browsershot is an open source tool from Spatie. It is used to convert web pages to images or pdfs. Browsershot versions prior to 5.0.1 have an input validation error vulnerability that stems from improper URL validation via the setUrl method, which allows an attacker to utilize bootstrap whitespa...

Improper Input Validation

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leadin...

firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack...