10398 matches found
Class Pollution
Overview deepdiff is a Deep Difference and Search of any Python object/data. Recreate objects by adding adding deltas to each other. Affected versions of this package are vulnerable to Class Pollution via the Delta constructor and manipulation of the SAFETOIMPORT set. An attacker can execute...
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
Summary Python class pollution is a novel vulnerability categorized under CWE-915. The Delta class is vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it can lead to Denial of Service and Remote Code Execution via insecure Pickle...
GHSA-MW26-5G2V-HQW3 DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
Summary Python class pollution is a novel vulnerability categorized under CWE-915. The Delta class is vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it can lead to Denial of Service and Remote Code Execution via insecure Pickle...
[SECURITY] [DLA 4291-1] node-cipher-base security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4291-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 03, 2025 https://wiki.debian.org/LTS -...
CVE-2025-9788
A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/adminclass.php. Executing manipulation of the argument idno can lead to sql injection. The attack can be launched remotely. Th...
CVE-2014-125127
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service DoS attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application...
PT-2025-36336
Name of the Vulnerable Software and Affected Versions DeepDiff versions 5.0.0 through 8.6.0 Description DeepDiff is a Python project for deep difference and search of data. Versions 5.0.0 through 8.6.0 are susceptible to class pollution through the Delta class constructor. When combined with a...
CVE-2014-125127: Allocation of Resources Without Limits or Throttling
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service DoS attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application...
CVE-2024-40653
A logic error in ConnectionServiceWrapper.java within the System component of Google Android allows for the indefinite retention of a permission in the background. This vulnerability could lead to a local elevation of privilege without requiring additional execution privileges, though user intera...
CVE-2024-51423
Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter...
kernel: net/sched: ets: use old 'nbands' while purging unused classes
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported schets test-case 1 crashing in etsclassqlennotify after recent changes from Lion 2. The problem is: in etsqdiscchange we purge unused DWRR queues; the...
kernel: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
A use-after-free UAF vulnerability, which also presents a potential infinite loop condition, has been resolved in the Linux kernel. This flaw affects the HFSC Hierarchical Fair Service Curve queuing discipline when it is used in conjunction with NETEM Network Emulation. A malicious user could...
kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate
In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fix race condition on qfqaggregate A race condition can occur when 'agg' is modified in qfqchangeagg called during qfqenqueue while other threads access it concurrently. For example, qfqdumpclass may trigger a...
CVE-2024-51423: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter...
QNAP QTS and QuTS hero out-of-bounds write vulnerabilities
QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...
CVE-2024-51423
Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter...
PT-2025-35573
Name of the Vulnerable Software and Affected Versions: Infor Global HR GHR versions 11.23.03.00.21 and before Description: A Cross Site Scripting issue exists in Infor Global HR GHR that allows a remote attacker to execute arbitrary code via the class parameter. Recommendations: Update Infor Glob...
CVE-2024-51423
Infor Global HR GHR versions 11.23.03.00.21 and before are vulnerable to a Cross-Site Scripting (XSS) flaw. This vulnerability occurs due to the improper handling of the class parameter , which can allow a remote attacker to achieve arbitrary code execution . To mitigate this risk, it is recommen...
Infor Global HR 安全漏洞
Infor Global HR is a software from Infor, Inc. with unified management of global employee data. A security vulnerability exists in Infor Global HR version 11.23.03.00.21 and earlier, which stems from improper handling of the class parameter and could lead to remote code execution...
