@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852

CVE-2025-36852 describes a critical vulnerability in remote cache extensions used by build systems with bucket-based remote caches (e.g., Amazon S3, Google Cloud Storage). The issue allows contributors with pull request privileges to inject compromised artifacts from untrusted environments into t...

Medium: ecs-init

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

CVE-2025-49284

Cross-Site Request Forgery CSRF vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through = 4.3...

CVE-2025-49284

Cross-Site Request Forgery CSRF vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through = 4.3...

CVE-2025-49284

CVE-2025-49284 is a CSRF vulnerability in the WordPress plugin WP Maintenance Mode & Site Under Construction . The initial document notes CSRF and that the affected range is from n/a through 4.3. The linked Red Hat entry corroborates the CSRF nature but provides no additional technical details ab...

CVE-2025-49284 WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through = 4.3...

PT-2025-24219 · Unknown · Wp Maintenance Mode & Site Under Construction

Name of the Vulnerable Software and Affected Versions: WP Maintenance Mode & Site Under Construction versions n/a through 4.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This is a type of attack where an attacker tricks a use...

CVE-2025-49284: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through = 4.3...

WordPress plugin WP Maintenance Mode & Site Under Construction 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Skalucy in WordPress Plugin WP Maintenance Mode & Site Under Construction versions = 4.3...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-979)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-979 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2025-981)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-981 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

The vulnerability of the getUsers method in the software for managing and monitoring deleted objects in telemetry and telemechanics systems, such as the TeleControl Server Basic, allows a hacker to circumvent security restrictions, read and write arbitrary files, and execute arbitrary code.

The vulnerability of the getUsers method in software for managing and monitoring removed objects in telemetry and telemechanics systems related to the TeleControl Server Basic lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to...

Important: nerdctl

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-063)

The version of runfinch-finch installed on the remote host is prior to 1.8.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-063 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line...

Amazon Linux 2 : nerdctl (ALAS-2025-2863)

The version of nerdctl installed on the remote host is prior to 2.0.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2863 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a...

Parallel Kac'S Walk Generates PRU

Ma and Huang recently proved that the PFC construction, introduced by Metger, Poremba, Sinha and Yuen MPSY24, gives an adaptive-secure pseudorandom unitary family PRU. Their proof developed a new path recording technique MH24. In this work, we show that a linear number of sequential repetitions o...

The vulnerability of the HttpServletRequest.getParameter() function in the centralized multimedia content management system MagicINFO 9 allows a hacker to execute arbitrary code.

The vulnerability of the HttpServletRequest.getParameter function in the MagicINFO 9 centralized multimedia content management system is related to the improper creation of a file system path by combining a permanent directory, a temporary marker, and the fileName parameter. Exploiting this...

CVE-2025-21528

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable...