10947 matches found
EUVD-2011-5267
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting XSS via the handling of the "backendurl" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2025-8849 Denial of Service in danny-avila/librechat
LibreChat version 0.7.9 is vulnerable to a Denial of Service DoS attack due to unbounded parameter values in the /api/memories endpoint. The key and value parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessive...
CVE-2025-8849 Denial of Service in danny-avila/librechat
LibreChat version 0.7.9 is vulnerable to a Denial of Service DoS attack due to unbounded parameter values in the /api/memories endpoint. The key and value parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessive...
CVE-2025-8849 Denial of Service in danny-avila/librechat
LibreChat version 0.7.9 is vulnerable to a Denial of Service DoS attack due to unbounded parameter values in the /api/memories endpoint. The key and value parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessive...
CVE-2020-36869
Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly...
CVE-2011-10036
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting XSS via the handling of the "backendurl" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2025-61959
Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could...
CVE-2025-54459
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, serve...
CVE-2011-10036 Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting XSS via the handling of the "backendurl" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2011-10036 Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting XSS via the handling of the "backendurl" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2020-36857 Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page
Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not...
CVE-2024-58273 Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root
Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user or the backend shell user to escalate to root on the host...
CVE-2024-58273
CVE-2024-58273 affects Nagios Log Server prior to 2024R1.0.2. The vulnerability enables local privilege escalation when an attacker can run commands as the Apache web user (or backend shell user), escalating to root on the host. Red Hat and related sources corroborate the LPE exposure in affected...
CVE-2024-58273 Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root
Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user or the backend shell user to escalate to root on the host...
Malicious code in set-egs-backend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32 The package set-egs-backend was found to contain malicious code...
MAL-2025-49237 Malicious code in set-egs-backend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32 The package set-egs-backend was found to contain malicious code...
EUVD-2025-37056
Malicious code in set-egs-backend npm...
[SECURITY] Fedora 42 Update: bind-dyndb-ldap-11.11-7.fc42
This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...
squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling
A Information Disclosure vulnerability has been identified in the Squid web caching proxy. This flaw occurs when the application fails to properly redact sensitive Hypertext Transfer Protocol HTTP authentication credentials from an error response. A remote client can exploit this by triggering an...
EUVD-2025-36741
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, serve...