550 matches found
SUSE-SU-2025:03046-1 Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250829T154226 2025-08-29T15:42:26Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3884 GO-2025-3892 GO-2025-3893 GO-2025-3894 GO-2025-3895 GO-2025-3896 GO-2025-3897...
PT-2025-37338
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250829T154226 2025-08-29T15:42:26Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3884 GO-2025-3892 GO-2025-3893 GO-2025-3894 GO-2025-3895 GO-2025-3896 GO-2025-3897...
Django -- multiple vulnerabilities
Django reports: CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases...
Linux Distros Unpatched Vulnerability : CVE-2020-9274
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the lookupaliasconst...
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250814T182633 2025-08-14T18:26:33Z jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3765 CVE-2024-44906 GHSA-h4h6-vccr-44h2 GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp Upda...
SUSE-SU-2025:02912-1 Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250814T182633 2025-08-14T18:26:33Z jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3765 CVE-2024-44906 GHSA-h4h6-vccr-44h2 GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp -...
CVE-2025-55001 OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. Whe...
CVE-2025-55001 OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. Whe...
RubyGems, PyPI Hit by Malicious Packages Stealing Credentials, Crypto, Forcing Security Changes
A fresh set of 60 malicious packages has been uncovered targeting the RubyGems ecosystem by posing as seemingly innocuous automation tools for social media, blogging, or messaging services to steal credentials from unsuspecting users and likely resell them on dark web forums like Russian Market...
PT-2025-32383
Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the username as alias=true parameter in the LDAP auth method is used, the supplied username is used withou...
ASINT: Learning AS-To-Organization Mapping from Internet Metadata
Accurately mapping Autonomous Systems ASNs to their owning or operating organizations underpins Internet measurement research and security applications. Yet existing approaches commonly rely solely on WHOIS or PeeringDB, missing important relationships e.g., cross-regional aliases, parent-child...
Malicious PyPI, npm, and Ruby Packages Exposed in Ongoing Open-Source Supply Chain Attacks
Several malicious packages have been uncovered across the npm, Python, and Ruby package repositories that drain funds from cryptocurrency wallets, erase entire codebases after installation, and exfiltrate Telegram API tokens, once again demonstrating the variety of supply chain threats lurking in...
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250529T205903 2025-05-29T20:59:03Z jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3717 GO-2025-3718 GO-2025-3719 GO-2025-3720 GO-2025-3721 Update to version 0.0.20250527T2047...
GHSA-WMJH-CPQJ-4V6X Gradio CORS Origin Validation Bypass Vulnerability
A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function isvalidorigin of the component CORS Handler. The manipulation of the argument localhostaliases leads to origin validation error. It is possible to initiate the attack remotely. Th...
Origin Validation Error
Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Origin Validation Error through the isvalidorigin function. An attacker can manipulate the origin validation by altering the localhostaliases argumen...
CVE-2025-5320
CVE-2025-5320 affects gradio-app/gradio up to version 5.29.1. The vulnerability lies in the CORS Handler’s is_valid_origin function, where manipulating the localhost_aliases argument can lead to an origin validation error and potential privilege escalation. Exploitation is described as remote wit...
Gradio 访问控制错误漏洞
Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. An access control error vulnerability exists in Gradio versions 5.29.1 and earlier, which stems from an incorrect validation of the localhostalias...
PT-2025-23161
Name of the Vulnerable Software and Affected Versions gradio-app gradio versions up to 5.29.1 Description A problematic vulnerability has been found in the CORS Handler component, specifically affecting the is valid origin function. The issue arises from the manipulation of the localhost aliases...
CVE-2024-35221
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.fromyaml. fromyaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-bas...