CVE-2025-30188

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...

EUVD-2024-55053

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated...

PT-2025-44594

Name of the Vulnerable Software and Affected Versions Apache HTTP Cache affected versions not specified Description Malicious or unintentional API requests can be used to add a significant amount of data to caches. This can lead to the eviction of information required for the web frontend to...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange Germany. A security vulnerability exists in the Open-Xchange GmbH OX App Suite that stems from a malicious or unintentional API request that could cause a large amount of data to be added to the cache, thereby evictin...

PT-2025-44693

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q4.10 Liferay Portal 7.4 GA through update 92 Description The Document Library and Adaptive Media modules are affected by an issue where an incorrect...

FreeBSD : powerdns-recursor -- cache pollution (c4fb21e4-b579-11f0-871c-6805ca2fa271)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c4fb21e4-b579-11f0-871c-6805ca2fa271 advisory. PowerDNS Team reports: It has been brought to our attention that the Recursor does not apply...

CVE-2024-14006

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated...

CVE-2024-14006

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated...

CVE-2024-14006

Nagios XI prior to 2024R1.2.2 is affected by a host header injection vulnerability. The app trusts the user-supplied HTTP Host header when building absolute URLs, enabling an unauthenticated remote attacker to craft a Host header that can poison generated links or responses, potentially enabling ...

CVE-2024-14006 Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated...

CVE-2024-14006 Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated...

CLSA-2025-1761844638 Fix CVE(s): CVE-2023-49288, CVE-2023-5824

SECURITY UPDATE: excessive cached HTTP response header size causing worker process stall or crash - debian/patches/CVE-2023-5824.patch: Refactor serialized HTTP response header handling to prevent cache flow - CVE-2023-5824 SECURITY UPDATE: Use-After-Free in the HTTP Collapsed Forwarding Feature ...

webkitgtk: A website may be able to access sensor information without user consent

A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the enforcer that uses environment variables without sanitation. An attacker can execute arbitrary commands or cause a buffer overflow by supplying crafted input to the affected component. Remediation Upgrade...

CVE-2025-64131

Jenkins SAML Plugin 4.583.vc68232f7018a and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user...

CVE-2025-12450

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

SUSE CVE-2025-30189

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted...

PowerDNS Recursor Multiple Cache Pollution Vulnerabilities (2025-06)

PowerDNS Recursor is prone to multiple cache pollution vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-44505

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2.2 Description The application does not properly validate the user-supplied HTTP Host header when constructing URLs. This can allow a remote, unauthenticated attacker to inject a crafted Host header,...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.2.2 that stems from insufficient...