30851 matches found
CVE-2025-9889 ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery
The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmxactivateconnection function. This makes it possible for unauthenticated attackers to bind...
CVE-2025-9889 ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery
The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmxactivateconnection function. This makes it possible for unauthenticated attackers to bind...
PT-2025-40506
Name of the Vulnerable Software and Affected Versions ContentMX Content Publisher plugin for WordPress versions up to and including 1.0.6 Description The software is susceptible to a Cross-Site Request Forgery CSRF issue. This is caused by a lack of, or incorrect, nonce validation in the cmx...
CVE-2025-59752
Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...
Malicious Package
Overview exceptiongroup is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2025-59743 Multiple vulnerabilities in AndSoft's e-TMS
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'...
JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.
...
AndSoft e-TMS SQL注入漏洞
AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the SessionID cookie parameter in file /inc/connect/CONNECTION.ASP. An attacker can us...
CVE-2025-56019
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy BLE without authentication. Once an unauthorized connection is established, legitimate applications are unable to connect,...
PT-2025-40430
Name of the Vulnerable Software and Affected Versions Stalwart versions 0.13.3 and below Description Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory,...
PT-2025-40363
Name of the Vulnerable Software and Affected Versions AndSoft's e-TMS version 25.03 Description A SQL injection issue exists in AndSoft's e-TMS version 25.03. This allows an attacker to potentially retrieve, create, update, and delete databases by sending a POST request to the...
BIT-AIRFLOW-2025-54831 Apache Airflow: Connection sensitive details exposed to users with READ permissions
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...
CVE-2022-50447 Bluetooth: hci_conn: Fix crash on hci_create_cis_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix crash on hcicreatecissync When attempting to connect multiple ISO sockets without using DEFERSETUP may result in the following crash: BUG: KASAN: null-ptr-deref in hcicreatecissync+0x18b/0x2b0 Read of size...
CVE-2023-53476
CVE-2023-53476 affects the Linux kernel’s RDMA/cxgb4 code path (c4iw_fill_res_cm_id_entry). The issue arises when epcp is re-assigned; re-testing epcp->state == LISTEN after reassignment can dereference NULL listen_ep or ep, leading to a NULL pointer dereference. The vulnerability is triggered...
kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: exception RIP: nfctdeletefromlists+172 .. 7...
kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: exception RIP: nfctdeletefromlists+172 .. 7...
[SECURITY] [DLA 4305-2] firefox-esr regression update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4305-2 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 29, 2025 https://wiki.debian.org/LTS -...
CVE-2025-11130
A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTool.m of the component XPC Service. This manipulation causes missing authentication. The attack can only be executed locally. The exploit h...
Langley Online Banking System 代码注入漏洞
Langley Online Banking System is an online banking system from Langley Corporation. A code injection vulnerability exists in the Langley Online Banking System, which originates from a misuse of the parameter Error in file /connectionerror.php and could lead to a cross-site scripting attack...
Finding Phones Fast: Low-Latency and Scalable Monitoring of Cellular Communications in Sensitive Areas
The widespread availability of cellular devices introduces new threat vectors that allow users or attackers to bypass security policies and physical barriers and bring unauthorized devices into sensitive areas. These threats can arise from user non-compliance or deliberate actions aimed at data...