48688 matches found
openbabel:fuzz_molecule: Heap-use-after-free in OpenBabel::OBAngleData::FillAngleArray
Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5045393024155648 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7707b57e18...
lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.AttributeImpl.clone
Detailed Report: https://oss-fuzz.com/testcase?key=4833483632738304 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.lucene.util.AttributeImpl.clone...
GHSA-W42G-JJ8W-FJ77 Duplicate Advisory: phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9525-27vj-c8r8. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticat...
Duplicate Advisory: phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9525-27vj-c8r8. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticat...
CVE-2026-46367
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
CVE-2026-46367
phpMyFAQ prior to version 4.1.2 has a stored XSS vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, potentially stealing admin session cookies and achievin...
EUVD-2026-30578
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
CVE-2026-46367 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
CVE-2026-46367 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
CVE-2026-46367
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
CVE-2026-46367 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving...
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Summary Type: Cross-site request forgery on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest call, no isTokenValid check, n...
GHSA-3MV2-VMWH-RWFX AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Summary Type: Cross-site request forgery on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest call, no isTokenValid check, n...
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Impact NukeViet CMS , which are stored server-side and executed in the browser of any user who views the content. Who is impacted: - Administrators and moderators who view user-submitted content e.g., contact messages, comments, or any module using the Request class for HTML input. - The Contact...
GHSA-64RR-PP78-62WW NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Impact NukeViet CMS , which are stored server-side and executed in the browser of any user who views the content. Who is impacted: - Administrators and moderators who view user-submitted content e.g., contact messages, comments, or any module using the Request class for HTML input. - The Contact...
openbabel:fuzz_molecule: Stack-buffer-overflow in OpenBabel::OBMol::GetSpacedFormula
Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5668980231831552 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...
tensorflow:[email protected]: Heap-buffer-overflow in std::__1::pair<google::protobuf::Map<std::__1::basic_string<char, std::__1::char
Detailed Report: https://oss-fuzz.com/testcase?key=5381387644633088 Project: tensorflow Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzerasantensorflow Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...
openbabel:fuzz_molecule: Segv on unknown address in std::__1::basic_ostream<char, std::__1::char_traits<char>>::sentry::sentry
Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5357831149912064 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...
ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Heap-buffer-overflow in codec47_block
Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5024854725427200 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...
matio:matio_struct_cell_fuzzer: Heap-buffer-overflow in Mat_VarGetStructsLinear
Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=4617982608474112 Project: matio Fuzzing Engine: afl Fuzz Target: matiostructcellfuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow WRITE...