1418 matches found
CVE-2020-3916
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos...
RUSTSEC-2025-0036 surf is unmaintained
The developer has indicated that the crate is unmaintained. The last release is over three years old from 2021, the crate depends on the deprecated async-std crate and on a very old version of rustls for TLS support. Possible alternatives - reqwest - ureq...
PT-2025-21911 · Crates.Io · Surf
The developer has indicated that the crate is unmaintained. The last release is over three years old from 2021, the crate depends on the deprecated async-std crate and on a very old version of rustls for TLS support. Possible alternatives - reqwest - ureq...
CVE-2025-30147
Hyperledger Besu relies on besu-native to implement ALTBN128_ADD, ALTBN128_MUL, and ALTBN128_PAIRING precompiles. From Besu 24.7.1 through 25.2.2 (besu-native 0.9.0–1.2.1), a consensus bug could arise because the gnark-crypto bn254 implementation used for these precompiles did not perform proper ...
Do Not Install the TFTP Client
Trivial File Transfer Protocol TFTP is used for file transfer between a Linux server and other servers, desktop systems, as well as terminal devices. TFTP does not support authentication and encryption mechanisms. Data tends to be forged, tampered with, or stolen by attackers during communication...
SUSE CVE-2012-6153
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...
CVE-2025-26796
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...
CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...
编号撤回
LocalAI is a free, open-source alternative to OpenAI by the individual developer Ettore Di Giacinto. This CVE number has been withdrawn...
PT-2025-12322 · Unknown · Langgenius/Dify
Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: A weakness in the pseudo-random number generator PRNG used for generating password reset codes allows an attacker to take over any account, including administrator accounts. The application utilizes...
RUSTSEC-2025-0014 humantime is unmaintained
Latest humantime crates.io release is four years old and GitHub repository has not seen commits in four years. Question about maintenance status has not gotten any reaction from maintainer: https://github.com/tailhook/humantime/issues/31 Update: maintained again The maintainer has responded and...
The vulnerability of the Mozilla Firefox Focus browser, related to bypassing the authentication process through an alternative path or channel, allows attackers to circumvent screen lock settings.
The vulnerability of the Mozilla Firefox Focus browser relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent screen lock settings...
The vulnerability of the Ivanti Avalanche device management system, related to bypassing the authentication process by using an alternative path or channel, allows a perpetrator to circumvent the authentication process.
The vulnerability of the Ivanti Avalanche device management system relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent the authentication process...
The vulnerability of the Ivanti Avalanche device management system, related to bypassing the authentication process by using an alternative path or channel, allows a perpetrator to circumvent the authentication process.
The vulnerability of the Ivanti Avalanche device management system relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent the authentication process...
PT-2025-6216 · Rtmpdump · Rtmpdump
Name of the Vulnerable Software and Affected Versions: rtmpdump affected versions not specified Description: The version of rtmpdump contained in the package has multiple known issues. There is no patched release available. It is recommended to install rtmpdump from another source. Recommendation...
CVE-2024-33042
Memory corruption when Alternative Frequency offset value is set to 255...
PT-2025-5567 · Apache · Apache Cocoon
Name of the Vulnerable Software and Affected Versions: Apache Cocoon versions all versions Description: The issue is related to the incorrect usage of seeds in the pseudo-random number generator PRNG in Apache Cocoon. When a continuation is created, it gets a random identifier. Because the random...
The vulnerability of the Command Line Interface (CLI) of the Fortinet FortiClient security device allows a perpetrator to increase their privileges and execute arbitrary code.
The vulnerability of the Command Line Interface CLI of the Fortinet FortiClient security device relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary code by sendi...
BIT-PYTHON-MIN-2023-36632
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed ...