13306 matches found
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
CVE-2024-57969: Incorrect Authorization
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
PT-2025-6763 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.198 Description: The issue concerns the app/Model/Attribute.php file in MISP, where it ignores an ACL during a GUI attribute search. Recommendations: For versions prior to 2.4.198, update to version 2.4.198 or later...
CVE-2025-24875
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...
CVE-2024-13658
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hrSISnextgensearchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
jinja2: accepts keys containing non-attribute characters
A flaw was found in jinja2. The xmlattr filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as opposed to only values as user input, and...
CVE-2025-24900
Concorde (Nexkey) vulnerability: lack of CSRF protection and misconfigured cookies for MediaProxy authentication allow bypassing authentication, enabling image loading without restrictions. Affects versions prior to 12.25Q1.1 (SameSite attribute missing); prior to 12.24Q2.3 the same cookie also a...
Astra Linux – Vulnerability in hdf5
HDF5 through 1.14.3 contains a heap buffer overflow issue in H5Aattrreleasetable, which leads to the corruption of the instruction pointer and causes denial of service or potential code execution...
CVE-2025-24875
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...
CVE-2025-24875 SameSite Defense in Depth not applied for some cookies in SAP Commerce
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...
CVE-2025-24875
CVE-2025-24875 corresponds to SAP Commerce where the Backoffice authentication cookies are by default configured with SameSite=None. Root cause: cookies set to None, weakening CSRF protections. Impact: CSRF risk with potential confidentiality/integrity concerns; exploitation status not detailed i...
Azure Linux 3.0 Security Update: kernel (CVE-2024-26934)
The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26934 advisory. - In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in...
Azure Linux 3.0 Security Update: kernel (CVE-2024-26933)
The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26933 advisory. - In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port disable...
CVE-2024-55630
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the "name" attribute to be specified. If "name" is set to the same value as an existing "document" property e.g. "querySelector", that...
Directory Traversal
Overview xml2rfc is a Xml2rfc generates RFCs and IETF drafts from document source in XML according to the IETF xml2rfc v2 and v3 vocabularies. Affected versions of this package are vulnerable to Directory Traversal through the src attribute in artwork or sourcecode elements due to improper...
Joplin input validation vulnerability
Joplin is an open source note-taking and to-do list application by Laurent Cozic Individual Developer. Joplin suffers from an input validation error vulnerability that originates in Joplin's HTML cleanup program that could result in a denial of service if the value of the specified name attribute...
Astra Linux - уязвимость в linux-5.10
ntfsattrfind in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service kernel oops or panic or possibly have unspecified other impact via a crafted ntfs filesystem...