12985 matches found
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact A malicious user could feed a specially crafted archive to this library causing RCE, modification of files or other bad things in the context of whatever user is running this library as, through the program that imports it. The severity highly depends on the user's permissions and...
BIT-DISCOURSE-2025-24972 Discourse may bypass user preference when adding users to chat groups
Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions 3.3.4 and 3.4.0.beta5 contai...
CVE-2025-27793
A Cross-site scripting flaw was found in the Vega library for Node.js. In affected versions, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs unless the library was used with the vega-interpreter. Mitigation As a workaround, use vega with...
PT-2025-20570
Name of the Vulnerable Software and Affected Versions Tenda FH451 version 1.0.0.9 Description The issue is related to a stack overflow in the P2pListFilter function. Recommendations For Tenda FH451 version 1.0.0.9, consider disabling the P2pListFilter function as a temporary workaround until a...
PT-2025-13567
Name of the Vulnerable Software and Affected Versions HDF5 versions up to 1.14.6 Description A problematic issue was found in HDF5, affecting the H5HL fl deserialize function in the file src/H5HLcache.c. The manipulation of the free block argument leads to a heap-based buffer overflow. This issue...
PT-2025-13543 · Ericsson +6 · Erlang/Otp +6
Name of the Vulnerable Software and Affected Versions: Erlang/OTP versions prior to 27.3.1 Erlang/OTP versions prior to 26.2.5.10 Erlang/OTP versions prior to 25.3.2.19 Description: A maliciously formed KEX init message can result in high memory usage due to the implementation not verifying RFC...
CVE-2025-30222
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...
CVE-2023-52990
Removed by vendor...
CVE-2025-27793
Vega (visualization grammar) and the related Vega-lite JSON workflow are affected by CVE-2025-27793. In Vega versions prior to 5.32.0 (and vega-functions prior to 5.17.0), processing Vega/Vega-lite JSON could cause execution of unintended JavaScript unless the library is used with the vega-interp...
SUSE CVE-2025-30164
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...
PT-2025-13241 · Code Projects · Payroll Management System
Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue was found in the Payroll Management System. The problem affects an unknown functionality of the file update employee.php. The manipulation of the emp type...
PT-2025-13055 · Wip · Woocarousel Lite
Name of the Vulnerable Software and Affected Versions: WIP WooCarousel Lite versions 1.1.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can execute malicious scripts on the victim's browser,...
PT-2025-13280 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.0-rc4-syzkaller-00362-gfef7fd48922d Description: A bug was found in the f2fs component of the Linux kernel, where a sanity check on i extra isize in the is alive function was missing, resulting in a...
PT-2025-13389 · Ibm · Ibm Cloud Pak System
Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.0 through 2.3.4.1 Description: The issue could allow a user with access to the network to obtain sensitive information from CLI arguments. Recommendations: For versions 2.3.3.0 through 2.3.4.1, consider...
PT-2025-13094 · Igor Benic · Igor Benic Simple Giveaways
Name of the Vulnerable Software and Affected Versions: Igor Benic Simple Giveaways versions 2.48.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized access...
PT-2025-13223 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.12.0-rc7+ Description: A vulnerability in the Linux kernel has been resolved, specifically in the RDMA/mlx5 component. The issue was related to an implicit ODP hang on parent deregistration. The problem occurr...
GHSA-6PHG-4WMQ-H5H3 Frappe has possibility of SQL injection due to improper validations
Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present...
UBUNTU-CVE-2025-27405
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...
Shescape has potential environment variable exposure on Windows with CMD
Impact This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp from "node:childprocess"; import...