26425 matches found
Hope-Boot input validation vulnerability
Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. An input validation error vulnerability exists in Hope-Boot version 1.0.0, which stems from mishandling of the parameter redirecturl in the doLogin function in WebController.java, which could lead to an open redire...
kubernetes allows nodes to bypass dynamic resource allocation authorization checks
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of t...
DEBIAN-CVE-2025-4563
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
AZL-64304 CVE-2025-4563 affecting package kubernetes for versions less than 1.30.10-9
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
CVE-2025-4563 Nodes can bypass dynamic resource allocation authorization checks
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
CVE-2025-4563 Nodes can bypass dynamic resource allocation authorization checks
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
CVE-2025-4563
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...
mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.13.0)
mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...
CVE-2025-2171
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...
CVE-2025-2172
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...
CVE-2025-2172
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...
CVE-2025-2172
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...
CVE-2025-2172
Aviatrix Controller is affected in versions prior to 7.1.4208, 7.2.5090, and 8.0.0 due to insufficient input sanitization before passing data to command line utilities, enabling command injection via special characters in filenames. The issue is documented with fixed releases: upgrade to 7.1.4208...
CVE-2025-2171
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...
CVE-2025-2171
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...
CVE-2025-2171
CVE-2025-2171 affects Aviatrix Controller. The issue is a failure to enforce rate limiting on password reset attempts, allowing brute‑force guessing of the 6‑digit reset PIN. Affected versions are Aviatrix Controller before 7.1.4208, 7.2.5090, and 8.0.0. Public sources in the connected documents ...
CVE-2025-49973
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable...
CVE-2025-25037
An information disclosure vulnerability exists in Aquatronica Controller System firmware versions = 5.1.6 and web interface versions = 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration...
CVE-2025-2172: Improper Neutralization of Special Elements used in an OS Command
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...