6414 matches found
UBUNTU-CVE-2025-3608
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2...
CVE-2025-30964
Server-Side Request Forgery SSRF vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from n/a through 7.7.6...
AZL-60411 CVE-2025-32909 affecting package libsoup for versions less than 3.4.4-4
A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniffmp4 function. The HTTP server may cause the libsoup client to crash...
AZL-60393 CVE-2025-32909 affecting package libsoup for versions less than 3.0.4-7
A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniffmp4 function. The HTTP server may cause the libsoup client to crash...
CVE-2024-9230
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks...
SoftCOM iKSORIS 跨站脚本漏洞
SoftCOM iKSORIS is an application from SoftCOM, Inc. A cross-site scripting vulnerability exists in SoftCOM iKSORIS versions prior to 79.0, which stems from a reflective cross-site scripting attack that could lead to malicious script execution...
CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3
CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3. A patched version of the package is available...
AZL-59888 CVE-2025-32728 affecting package openssh for versions less than 9.8p1-4
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding...
📄 WordPress Buddypress Humanity 1.2 Cross Site Request Forgery
WordPress Buddypress Humanity plugin versions 1.2 and below suffer from a cross site request forgery vulnerability. ⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin...
AZL-59979 CVE-2025-32387 affecting package cert-manager for versions less than 1.12.15-4
Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3...
CVE-2025-31020
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through = 1.4...
Drupal Gif Player Field module < 1.5.0,2.0.0-2.0.3 - Authenticated Cross Site Scripting (XSS) vulnerability
Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Gif Player Field versions 1.5.0,2.0.0-2.0.3...
Drupal ECA: Event - Condition - Action module < 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability
Drupal ECA: Event - Condition - Action module 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Juraj Nemec poker10 in WordPress Module ECA: Event - Condition - Action versions 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2...
Drupal Panels module < 4.9.0 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by Manuel Adán manuel.adan in WordPress Module Panels versions 4.9.0...
Drupal WEB-T module < 1.1.0 - Unauthenticated Multiple Vulnerabilities vulnerability
Unauthenticated Multiple Vulnerabilities vulnerability discovered by Jan Kellermann jan kellermann in WordPress Module WEB-T versions 1.1.0...
AZL-59656 CVE-2025-22871 affecting package golang for versions less than 1.18.8-7
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...
AZL-59772 CVE-2025-22014 affecting package kernel for versions less than 5.15.180.1-1
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: Fix the potential deadlock When some client process A call pdraddlookup to add the look up for the service and does schedule locator work, later a process B got a new server packet indicating locator is up and cal...
AZL-59722 CVE-2025-32414 affecting package libxml2 for versions less than 2.10.4-7
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters...
AZL-59745 CVE-2025-29481 affecting package bcc for versions less than 0.29.1-3
Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpfobjectinitprog function of libbpf. This has been disputed by third parties who assert that "no one in their sane mind should be passing untrusted ELF files into libbpf while running under...