7519 matches found
CVE-2023-47639 API Platform Core can leak exceptions message that may contain sensitive information
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5...
GHSA-RFW5-CQJJ-7V9R API Platform Core can leak exceptions message that may contain sensitive information
Summary Exception messages, that are not HTTP exceptions, are visible in the JSON error response. Details While we wanted to make our errors compatible with the JSON Problem specification, we ended up handling more exceptions then we did previously introduced at...
OESA-2025-1368 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes:...
OESA-2025-1367 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes:...
OSV-2025-253 Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken...
Sensitive Information Exposure
org.apache.commons, commons-vfs2 is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of exception messages, where the FtpFileObject class exposes the original URI, including sensitive information like passwords, when a file is not found. It allows an...
API Platform Core 安全漏洞
API Platform Core is a server component of API Platform open source by API Platform. A security vulnerability exists in API Platform Core version 3.2.0 that stems from a non-HTTP exception message being visible in a JSON error response...
PyTorch Denial of Service Vulnerability (CNVD-2025-23355)
PyTorch is a Python package open-sourced by PyTorch. PyTorch suffers from a denial of service vulnerability caused by a floating point exception in the function torch.mkldnnmaxpool2d. An attacker can exploit this vulnerability to cause a denial of service...
The vulnerability of the iommu_report_device_fault() function in the Linux kernel’s IOMMU support driver allows a attacker to trigger a service failure.
The vulnerability of the iommureportdevicefault function in the Linux kernel’s IOMMU support driver is related to deficiencies in exception handling. Exploiting this vulnerability can allow an attacker to cause a service failure...
GHSA-26WH-CC3R-W6PJ canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...
canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...
CVE-2025-31479 canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...
The vulnerability of the __btrfs_cow_block() function in the Btrfs file system of Linux kernels allows a attacker to cause a service failure.
The vulnerability of the btrfscowblock function in the Btrfs file system of Linux operating systems is related to insufficient checking of exception states. Exploiting this vulnerability could allow an attacker to cause a service failure...
SUSE CVE-2025-31162
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via getslope function...
Cross-site Scripting (XSS)
Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the error handling in DefaultExceptionHtmlSubscriber.php, which does not sufficiently filter its...
Improper Resource Shutdown or Release
Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the torch.mkldnnmaxpool2d function. An attacker can disrupt service by exploiting this vulnerability locally...
OESA-2025-1343 arm-trusted-firmware security update
Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures Armv8-A and Armv7-A, including an Exception Level 3 EL3 Secure Monitor. Security Fixes: An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a...
CVE-2025-31162
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via getslope function...
