217836 matches found
PT-2026-2045
Name of the Vulnerable Software and Affected Versions Merit LILIN IP Camera models affected versions not specified Description Certain IP Camera models developed by Merit LILIN are susceptible to an OS Command Injection issue. Authenticated remote attackers can exploit this to inject and execute...
Advantech多款产品 安全漏洞
Advantech, a China-based Advantech company, provides intelligent electric bus management systems as one of its applications. A security vulnerability exists in Advantech that originates from an unauthenticated, remote attacker who can execute arbitrary SQL commands, potentially resulting in a SQL...
CVE-2025-66689
A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the isdangerouspath validation function that uses exact string matching against a blacklist of system...
CVE-2025-66689
A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the isdangerouspath validation function that uses exact string matching against a blacklist of system...
The vulnerability of the Go programming language, related to the shortcomings in the authentication process, allows attackers to compromise the confidentiality and integrity of the protected information.
The vulnerability of the Go programming language is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality and integrity of the protected information...
Cross-site Scripting (XSS)
Overview @questdb/web-console is a QuestDB Web Console Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Web Console component. An attacker can inject and execute arbitrary scripts by submitting crafted input that is not properly sanitized. Details Cross-site...
CVE-2026-22702
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU Time-of-Check-Time-of-Use vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a rac...
CVE-2026-22702
CVE-2026-22702 concerns the Python tool for creating isolated environments, virtualenv. The issue is a TOCTOU race in directory creation where a local attacker can exploit a window between existence checks and creation to redirect virtualenv’s app_data and lock files to attacker-controlled locati...
CVE-2026-22702 virtualenv Has TOCTOU Vulnerabilities in Directory Creation
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU Time-of-Check-Time-of-Use vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a rac...
SUSE SLED15 / SLES15 Security Update : python-filelock (SUSE-SU-2026:0082-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0082-1 advisory. - CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files bsc125524...
virtualenv -- CWE-59: Improper Link Resolution Before File Access ('Link Following')
https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 reports: virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU Time-of-Check-Time-of-Use vulnerabilities in virtualenv allow local attackers to perform symlink-based attac...
CVE-2014-4161
Cross-site scripting XSS vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to inject arbitrary web script or HTML via the url parameter...
CVE-2014-4945
Multiple cross-site scripting XSS vulnerabilities in Horde Internet Mail Program IMP before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic 1 mailbox or 2 message view...
CVE-2014-4033
Cross-site scripting XSS vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary web script or HTML via the surname parameter to student.php...
CVE-2014-4308
Multiple cross-site scripting XSS vulnerabilities in NICE Recording eXpress aka Cybertech eXpress before 6.5.5 allow remote attackers to inject arbitrary web script or HTML via the 1 USRLNM parameter to myaccount/mysettings.edit.validate.asp or the frame parameter to 2...
CVE-2014-4191
The TLS implementation in EMC RSA BSAFE-C Toolkits aka Share for C and C++ sends a long series of random bytes during use of the DualECDRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recovering the algorithm's inner state, a different issue than...
CVE-2014-4335
Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 host or 2 password parameter to rtl/protected/admin/ddns/...
CVE-2014-4719
Cross-site scripting XSS vulnerability in the login panel svn/login/ in User-Friendly SVN aka USVN before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field...
CVE-2005-1784
Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp...