1312386 matches found
Running user provided regular expression, lead to DOS
This report is not public...
Unauthenticated Denial of Service (DoS) via Multipart Boundary in recent integration of Gradio UI
This report is not public...
Open Redirect
This report is not public...
Mars: Insecure API Response Leads to Disclosure of Hashed Passwords
A security vulnerability was identified in the API of ████████. The endpoint ████████ was found to return sensitive user information, including hashed passwords, in its response. This exposure presented a significant security risk, as it potentially allowed unauthorized access to user credentials...
AWS VDP: Reflected XSS on Amazon EC2 Instance
Product: Amazon Elastic Compute Cloud Amazon EC2 Vulnerability Type: Reflected Cross-Site Scripting XSS CVE: CVE-2022-29548 Severity: Medium Description: A reflected XSS vulnerability was discovered on the Amazon EC2 instance, allowing an attacker to inject malicious JavaScript code, potentially...
7z slip lead to remote code execution
This report is not public...
rar slip lead to remote code execution
This report is not public...
WordPress: Unauthenticated WordPress Database Repair DoS
Vulnerability description not provided...
AWS VDP: Information Disclosure Due To exposed .env file (Directory Listing) at ████████
Vulnerability description not provided...
Local File Inclusion in netease-youdao/qanything
This report is not public...
Redos (Regular Expression Denial of Service)
This report is not public...
server crash by zip bomb
This report is not public...
Linux Foundation Decentralized Trust: Memory Leak in bytes_to_hexstring Function
The function bytestohexstring was found to have a memory leak vulnerability. The function dynamically allocated memory using malloc but did not provide a way for the caller to free the allocated memory. This could lead to an increase in the program's memory consumption over time, potentially...
pickle deserialization vulnerability
Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...
Nextcloud: Exposing debug.log file leads to server full path disclosure
The debug.log file on the nextcloud.com website was publicly accessible and contained sensitive information, including the server's full directory path. This type of information disclosure could have assisted attackers in understanding the internal structure of the server...
U.S. Dept Of Defense: [ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
The CVE-2018-1000129 vulnerability allowed remote cross-site scripting RXSS at the specified URL. The vulnerability was due to improper sanitization of user input, which enabled the execution of arbitrary scripts in the victim's browser...
MercadoLibre: Es posible poder navegar a cualquier pagina en Point Smart application
The vulnerability allowed users to navigate outside the intended application environment through a link in the Point Smart application...
U.S. Dept Of Defense: Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`
The endpoint at https://████/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/ was vulnerable to unauthenticated local file inclusion using the symbol '!'. This allowed reading local files on the server, such as /etc/passwd and /etc/crontab...
MTN Group: Cisco IOS XE instance at ████ vulnerable to CVE-██████
A vulnerability was discovered in a Cisco IOS XE instance that allowed bypassing authentication to reach a web endpoint and execute arbitrary Cisco IOS commands or make configuration changes with Privilege 15 privileges. The vulnerability was characterized by improper path validation to bypass...