CVE-2026-28807 Path Traversal in wisp.serve_static allows arbitrary file read

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.servestatic function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded...

Alibaba Cloud Linux 3 : 0040: freerdp (ALINUX3-SA-2026:0040)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0040 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-22855: FreeRDP is a free...

USN-7954-2 libtasn1-6 vulnerabilities

USN-7954-1 fixed vulnerabilities in Libtasn1. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2021-46848 only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was...

Linux Distros Unpatched Vulnerability : CVE-2025-62348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintende...

MiracleLinux 4 : openssl-1.0.1e-42.AXS4.1 (AXSA:2015-934:07)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-934:07 advisory. Security issues fixed with this release: CVE-2015-3194 crypto/rsa/rsaameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote...

EUVD-2019-19209

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2021-21861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. When...

GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields

...

Linux Distros Unpatched Vulnerability : CVE-2019-12529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the...

Libmodsecurity3 Bypass

The vulnerability of the Libmodsecurity3 network firewall library for protecting web applications with ModSecurity is related to incorrect processing of HTML entities during decoding. Exploiting this vulnerability allows an attacker to bypass existing security restrictions by sending HTML entitie...

USN-7141-1 ofono vulnerabilities

It was discovered that oFono incorrectly handled decoding SMS messages leading to a stack overflow. A remote attacker could potentially use this issue to cause a denial of service. CVE-2023-2794, CVE-2023-4233, CVE-2023-4234...

Undertow AjpRequestParser DoS

The vulnerability of the AjpRequestParser class in the ajp-listener component of the Undertow web server is related to an uncontrolled resource consumption due to incorrect decoding of request paths. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2023-41104

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL Varnish Configuration...

Design/Logic Flaw

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through CallBuilder::delegate or...

SUSE CVE-2019-9853

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...

ReactPHP HTTP security vulnerabilities

ReactPHP HTTP is a ReactPHP open source event-driven, streaming HTTP client and server implementation of ReactPHP. A security vulnerability exists in ReactPHP HTTP versions prior to 0.7.0 through 1.7.0 that stems from the fact that when ReactPHP processes incoming HTTP cookie values, the cookie...

CVE-2022-28664

A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.The freshtomato-mips has a vulnerable URL-decoding feature that...

AZL-9909 CVE-2022-27780 affecting package curl for versions less than 7.83.1-1

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get...

GPAC Project Advanced Content Buffer Error Vulnerability

GPAC is an open source multimedia framework. a security vulnerability exists in the MPEG-4 decoding feature of GPAC on Advanced Content library v1.0.1. An attacker could exploit the vulnerability to cause incorrect memory allocation via a carefully constructed MPEG-4 input, which could lead to a...

dotnet: ASP.NET cookie prefix spoofing vulnerability

A flaw was found in ASP.NET. Certain cookie values are not properly decoded allowing a remote attacker to bypass the "Cookie Prefixes" security mechanism. The highest threat from this vulnerability is to data integrity...