CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-17633

For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...

CVE-2019-15028

In Joomla! before 3.9.11, inadequate checks in comcontact could allow mail submission in disabled forms...

CVE-2017-1000489

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address...

CVE-2010-4143

SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2019-19251

The Last.fm desktop app Last.fm Scrobbler through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts...

CVE-2010-4517

SQL injection vulnerability in the JExtensions JE Auto comjeauto component 1.0 for Joomla!, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the char parameter in an item action to index.php...

CVE-2019-15325

In GalliumOS 3.0, CONFIGSECURITYYAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptracescope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not...

CVE-2010-2340

SQL injection vulnerability in members.php in Arab Portal 2.2, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action...

CVE-2010-0057

AFP Server in Apple Mac OS X before 10.6.3 does not prevent guest use of AFP shares when guest access is disabled, which allows remote attackers to bypass intended access restrictions via a mount request...

CVE-2012-6105

blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed...

CVE-2006-4527

includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magicquotesgpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers to conduct PHP remote file inclusion attacks...

CVE-2006-4939

backup/backupscheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname...

CVE-2009-2132

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter...

CVE-2002-1923

The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection...

SUSE CVE-2025-37895

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix error handling path in bnxtinitchip WARNON is triggered in flushwork if bnxtinitchip fails because we call cancelworksync on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at kernel/workqueue.c:420...

DEBIAN-CVE-2025-37895

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix error handling path in bnxtinitchip WARNON is triggered in flushwork if bnxtinitchip fails because we call cancelworksync on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at kernel/workqueue.c:420...

UBUNTU-CVE-2025-37895

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix error handling path in bnxtinitchip WARNON is triggered in flushwork if bnxtinitchip fails because we call cancelworksync on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at kernel/workqueue.c:420...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the BNXTSTATENAPIDISABLED bit not being set correctly in the bnxtinitchip error handling path, which could...

PT-2025-22157 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the bnxt en driver. The issue occurs when the bnxt init chip function fails, triggering a WARN ON in flush work becaus...