Discourse 命令注入漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A command injection vulnerability exists in Discourse 3.5.0 and prior versions, which stems from a malicious meta-command that can be...

FreeBSD : py-mysql-connector-python -- Vulnerability in the MySQL Connectors product of Oracle MySQL (cb570d6f-9ea9-11f0-9446-f02f7497ecda)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cb570d6f-9ea9-11f0-9446-f02f7497ecda advisory. Oracle reports: Vulnerability in the MySQL Connectors product of Oracle MySQL component:...

PT-2025-40244

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The function get blanket orders at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can potentially extract information from databases by injecting a SQL query into the...

IMPAQTR Aurora 安全漏洞

IMPAQTR Aurora is a data statistics platform from IMPAQTR Belgium. A security vulnerability exists in IMPAQTR Aurora versions prior to 1.36 that stems from an insecure direct object reference that could lead to access to arbitrary organizational information...

CVE-2025-36262

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input...

CVE-2025-36262

IBM Planning Analytics Local is affected in versions 2.0.0–2.0.106 and 2.1.0–2.1.13. The issue is due to improper input validation that could allow a malicious privileged user to bypass the UI and access sensitive information. No exploit details are provided in the documents. Remediation is to up...

CVE-2025-55795

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with ...

PT-2025-40023

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13 Description A malicious privileged user may be able to bypass the user interface to obtain unauthorized access to sensitive...

Advisory ROSA-SA-2025-3021

software: cjson 1.7.19 AXIS: ROSA-CHROME unaffected versions = cjson-1.7.19-1 affected versions cjson-1.7.19-1 CVE-ID: CVE-2025-57052 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: Vulnerability in cJSON 1.5.0-1.7.18: allows a remote attacker to perform array escaping via decodearrayindexfrompointer...

Vulnerabilities fixed in GitLab EE & CE

GitLab has fixed vulnerabilities in GitLab CE/EE Specifically for versions before 18.2.7, 18.3.3, and 18.4.1. The vulnerabilities include allowing authenticated users to access confidential information by creating projects with the same name as the victim, and gaining unauthorized access to...

mysql: mysqldump unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

mysql: mariadb: mysqldump unspecified vulnerability (CPU Apr 2025)

A flaw was found in Oracle MySQL Client mysqldump component. A low-privileged remote attacker with network access can gain unauthorized access to critical data and modify data accessible to MySQL Client...

The vulnerability in the jfs_dmap.c component of the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the jfsdmap.c component in the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the bpf component in the Linux operating system’s kernel allows a hacker to gain access to confidential data and also cause a service failure.

The vulnerability of the bpf component in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to access confidential data and also cause service failures...

The vulnerability of the dispc.c component in the Linux operating system’s kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the dispc.c component in the Linux operating system’s kernel is related to memory initialization errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the web page rendering module in WebKitGTK and WPE WebKit, related to the occurrence of operations outside the buffer in memory, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering module in WebKitGTK and WPE WebKit relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Code-Projects E-Commerce Website SQL注入漏洞

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the pages/adminproductdetails.php file that does not perform security filtering on the prodid parameter. An attacker can exploit this vulnerability by manipulating the...

The vulnerability of the parisc component in the Linux operating system’s kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the parisc component in the Linux operating system’s kernel is related to errors during resource release. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the arm.c component in the Linux operating system’s kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the arm.c component in the Linux operating system’s kernel is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Linux operating system’s kernel, related to the use of memory after it is freed, allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...