8976 matches found
CVE-2025-21706 mptcp: pm: only set fullmesh for subflow endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcppmnlfullmesh expects to change it only on 'subflow' endpoints, to recreate more or less...
CVE-2025-21706
CVE-2025-21706 is a Linux kernel vulnerability in the MPTCP path-manager. The in-kernel path-manager’s netlink set_flags path allowed non-subflow endpoints to receive the fullmesh flag due to a permissive hook, enabling an issue observed by syzbot warnings in net/mptcp/pm_netlink.c. The root caus...
CVE-2025-21706 mptcp: pm: only set fullmesh for subflow endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcppmnlfullmesh expects to change it only on 'subflow' endpoints, to recreate more or less...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from mptcp pm setting fullmesh only for subflow endpoints...
CVE-2024-53573
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/id...
CVE-2024-53573
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/id...
CVE-2025-27112
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
CVE-2024-53573
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/id...
CVE-2024-53573
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/id...
Unifiedtransform 安全漏洞
Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform v2.X. The vulnerability stems from improper access control, which allows unauthorized users to access and operate the management endpoints...
CVE-2024-53573
Unifiedtransform v2.X is vulnerable to Incorrect Access Control, enabling unauthorized users to access and manipulate administrative endpoints, specifically the teacher/edit/{id} path. The available data describes the root cause as improper access control, with impact described as high for confid...
PT-2025-7912 · Localsend · Localsend
Name of the Vulnerable Software and Affected Versions: LocalSend versions prior to 1.17.0 Description: The issue arises from the missing sanitization of the path in the "POST /api/localsend/v2/prepare-upload" and "POST /api/localsend/v2/upload" endpoints, allowing a malicious file transfer reques...
AWS VDP: Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The DocumentDB Elastic service was found to have three non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials...
CVE-2024-57176
An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL...
CVE-2024-57176
An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL...
PT-2025-7447 · Unknown · White-Jotter
Name of the Vulnerable Software and Affected Versions: White-Jotter version 0.2.2 Description: An issue in the shiroFilter function allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL. Recommendations: Update to a newer version of White-Jotter that...
CVE-2024-57176
CVE-2024-57176 affects White-Jotter v0.2.2. Multiple sources describe a vulnerability in the shiroFilter function that allows directory traversal, enabling an attacker to access sensitive endpoints via a crafted URL. The issue is documented across CVE registries and vendor advisories with consist...
White-Jotter 安全漏洞
White-Jotter is a front-end and back-end separation project developed by Antabot individual developer using Vue+Spring Boot, with a full set of development tutorials. White-Jotter has a security vulnerability that stems from an issue in the shiroFilter function. An attacker exploiting this...
