8758 matches found
PT-2025-44678
Name of the Vulnerable Software and Affected Versions Google Chrome affected versions not specified Description A flaw exists in Google Chrome that could allow attackers to impact the system. The issue is related to an inappropriate implementation within the Extensions component. Recommendations ...
RUSTSEC-2025-0051 `xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...
PT-2025-34467 · Crates.Io · Xcb
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 12 security fixes: 414760982 Medium CVE-2025-8576: Use after free in Extensions. Reported by asnine on 2025-04-30 384050903 Medium CVE-2025-8577: Inappropriate implementation in Picture In Picture. Reported by Umar Farooq on 2024-12-14 423387026 Mediu...
Browser Extensions Can Exploit ChatGPT, Gemini in ‘Man in the Prompt’ Attack
Man in the Prompt attack shows how browser extensions can exploit ChatGPT, Gemini and other AI tools to steal data or inject hidden prompts...
SquareX Discloses Architectural Limitations of Browser DevTools in Debugging Malicious Extensions
Palo Alto, California, 29th July 2025, CyberNewsWire...
CLSA-2025-1753465703 php: Fix of 3 CVEs
CVE-2025-1220: error if host contains null bytes in the middle of the string - CVE-2025-6491: fix NULL pointer dereference vulnerability in soap - CVE-2025-1735: add error error checks for escape function is pgsql and pdopgsql extensions...
No Boss Extensions No Boss Testimonials component for Joomla 跨站脚本漏洞
No Boss Extensions No Boss Testimonials component for Joomla is a Joomla plugin from Brazilian company No Boss Extensions. A cross-site scripting vulnerability exists in the No Boss Extensions No Boss Testimonials component for Joomla versions 1.0.0 through 3.0.0 and 4.0.0 through 4.0.2, which...
The vulnerability of the websocket-extensions module in the Ruby programming language allows a hacker to trigger a service failure.
The vulnerability of the websocket-extensions module in the Ruby programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...
WordPress Extensions For CF7 Plugin Path Traversal Vulnerability
WordPress Extensions For CF7 Plugin is a plugin that extends the functionality of Contact Form 7, mainly used to enhance the database management, conditional logic processing and user guidance capabilities of native forms. The WordPress Extensions For CF7 Plugin suffers from a path traversal...
GetSimple CMS 安全漏洞
GetSimple CMS is a content management system from GetSimple CMS open source. A security vulnerability exists in GetSimple CMS version 3.2.1, which stems from the upload function not properly validating MIME types and extensions, which could lead to remote code execution...
ROS-20250724-06
A vulnerability in the Ruby websocket-extensions module that supports the implementation of WebSocket extensions is related to spending quadratic time parsing a header containing an unclosed string parameter value, which is a repeating two-byte sequence of backslash and some of backslash and some...
K000152677: Golang net/http vulnerabilities CVE-2023-39326 and CVE-2024-24791
Security Advisory Description CVE-2023-39326 A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to...
DJ-Extensions DJ-Reviews 跨站脚本漏洞
DJ-Extensions DJ-Reviews is a rating and review extension from DJ-Extensions. A cross-site scripting vulnerability exists in DJ-Extensions DJ-Reviews versions 1.0-1.3.6, which stems from a reflected cross-site scripting vulnerability...
WordPress plugin Extensions For CF7 路径遍历漏洞
WordPress Extensions For CF7 Plugin is a plugin that extends the functionality of Contact Form 7, mainly used to enhance the database management, conditional logic processing and user guidance capabilities of native forms. The WordPress Extensions For CF7 Plugin suffers from a path traversal...
GATEBLEED: Exploiting On-Core Accelerator Power Gating for High Performance and Stealthy Attacks on AI
As power consumption from AI training and inference continues to increase, AI accelerators are being integrated directly into the CPU. Intel's Advanced Matrix Extensions AMX is one such example, debuting on the 4th generation Intel Xeon Scalable CPU. We discover a timing side and covert channel,...
CVE-2025-44658
In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...
Regular Expression Denial of Service (ReDoS)
Overview pymdown-extensions is an Extension pack for Python Markdown. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the figure caption extension, pymdownx.blocks.caption. A user could exploit this vulnerability by crafting a malicious input tha...
VulnCheck KEV: CVE-2025-27505
GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. The REST API index can...
