CVE-2025-32577: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through = 1.0.23...

PT-2025-16073

Name of the Vulnerable Software and Affected Versions: hakeemnala Build App Online versions 1.0.0 through 1.0.23 Description: The issue is related to an improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion' vulnerability. This allows...

TP-LINK Deco BE65 Pro 操作系统命令注入漏洞

TP-LINK Deco BE65 Pro is a Wi-Fi 7 Mesh Router from China P&L TP-LINK. An operating system command injection vulnerability exists in versions prior to TP-LINK Deco BE65 Pro 1.1.2 Build 20250123, which stems from the presence of an OS command injection that could lead to the execution of arbitrary...

WordPress plugin Build App Online 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-32754

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SS...

Debian dla-4122 : libbssolv-perl - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4122 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4122-1 [email protected] https://www.debian.org/lts/security/...

DEBIAN-CVE-2025-3407

A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhwbuildtilesetfromimage. The manipulation of the argument hcount/vcount leads to out-of-bounds read. The attack can be launched remotely. This product takes...

UBUNTU-CVE-2025-3407

A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhwbuildtilesetfromimage. The manipulation of the argument hcount/vcount leads to out-of-bounds read. The attack can be launched remotely. This product takes...

PT-2025-15331

Name of the Vulnerable Software and Affected Versions: Nothings stb up to f056911 Description: A vulnerability was found in the function stbhw build tileset from image of the component Header Array Handler. The manipulation of the argument w leads to an out-of-bounds read. It is possible to launc...

CVE-2025-31723

A cross-site request forgery CSRF vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order...

@angular-devkit/build-angular (>=19.2.0-next.2, <=19.2.0), @angular/build (>=19.2.0-next.2, <=19.2.0) +41 more potentially affected by CVE-2025-31486 via vite (>=6.1.0, <=6.1.3)

vite NPM version =6.1.0, =19.2.0-next.2, =19.2.0-next.2, =1.0.7, =2.12.0, =2.12.0, =11.24.0, =0.0.1739797164641, =1.0.0, =0.0.0-experimental-989cf02-20250217-d62ba1cb, =0.0.0-experimental-0580205-20250209-2be35102, =0.0.0-snapshot-08bd566ea55152626f488c12d32ebce7e35b812d,...

@adhd/backlog (>=1.0.0, <=1.0.8), @adhd/react-hooks (2.2.1) +447 more potentially affected by CVE-2025-31486 via vite (>=5.0.0, <=5.4.16)

vite NPM version =5.0.0, =1.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview 1.0.1 - @beaker-tools/typescript-toolkit 1.3.0 - @beardeddudes/strapi-types 0.1.1 and more Source cves:...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +512 more potentially affected by CVE-2025-31486 via vite (>=4.0.0, <=4.5.11)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-31486 Source advisory: OSV:GHSA-XCJ6-PQ6G-QJ4X...

CVE-2025-31486 Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: CVE-2020-22037: Fixed unchecked return value of the initvlc function bsc1186756 CVE-2024-12361: Fixed null pointer dereference bsc1237358 CVE-2024-35368: Fixed double free via the rkmppretrieveframe function within libavcodec/rkmppdec.c...

JetBrains TeamCity Information Disclosure Vulnerability

JetBrains TeamCity is a powerful continuous integration and continuous delivery CI/CD tool developed by JetBrains. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from base64 encoded passwords being exposed in build logs. An attacker can exploit the vulnerabilit...

CVE-2025-3047

When running the AWS Serverless Application Model Command Line Interface SAM CLI build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A use...

Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

Jenkins Simple Queue Plugin 1.4.6 and earlier does not require POST requests for multiple HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to change and reset the build queue order. Simple Queue Plugin 1.4.7 requires POST requests...

GHSA-HCFH-QJCP-34Q9 Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

Jenkins Simple Queue Plugin 1.4.6 and earlier does not require POST requests for multiple HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to change and reset the build queue order. Simple Queue Plugin 1.4.7 requires POST requests...

CVE-2025-31723

A cross-site request forgery CSRF vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order...