6735 matches found
AZL-57893 CVE-2025-27221 affecting package ruby for versions less than 3.3.5-3
In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host...
CVE-2024-51953
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-51946
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
AZL-57707 CVE-2025-0684 affecting package grub2 for versions less than 2.06-25
A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesyste...
AZL-57703 CVE-2025-0678 affecting package grub2 for versions less than 2.06-25
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some ...
CVE-2025-27263
CVE-2025-27263 covers a SQL Injection in WordPress plugin Doctor Appointment Booking (NotFound Doctor Appointment Booking). Affected: Doctor Appointment Booking versions n/a through 1.0.0. Root cause: improper neutralization of input in SQL commands. Impact: confidentiality impact High (as per CV...
CVE-2025-26586
CVE-2025-26586 corresponds to a WordPress plugin issue: WordPress Events Planner
CVE-2025-23516 WordPress Sale with Razorpay plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through = 1.0...
CVE-2025-1723
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug...
AZL-57644 CVE-2025-1744 affecting package cloud-hypervisor for versions less than 32.0-6
Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before 5.9.9...
AZL-57501 CVE-2025-1744 affecting package ceph for versions less than 18.2.2-6
Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before 5.9.9...
AZL-57836 CVE-2025-21787 affecting package kernel for versions less than 5.15.179.1-1
In the Linux kernel, the following vulnerability has been resolved: team: better TEAMOPTIONTYPESTRING validation syzbot reported following splat 1 Make sure user-provided data contains one nul byte. 1 BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:633 inline BUG: KMSAN: uninit-value in...
AZL-57974 CVE-2024-58020 affecting package kernel for versions less than 6.6.79.1-1
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mtinputconfigured devmkasprintf can return a NULL pointer on failure,but this returned value in mtinputconfigured is not checked. Add NULL check in mtinputconfigured, to handle kernel NULL point...
CVE-2025-26603 affecting package vim for versions less than 9.1.0791-4
CVE-2025-26603 affecting package vim for versions less than 9.1.0791-4. A patched version of the package is available...
AZL-57353 CVE-2025-22869 affecting package gh for versions less than 2.62.0-7
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
AZL-57428 CVE-2025-22869 affecting package kubernetes for versions less than 1.28.4-15
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
AZL-57488 CVE-2025-22869 affecting package kubevirt for versions less than 0.59.0-25
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
AZL-57485 CVE-2025-22869 affecting package terraform for versions less than 1.3.2-24
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...