31764 matches found
CVE-2025-43802
Stored cross-site scripting XSS vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web...
CVE-2025-59154
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
CVE-2025-59347 Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat job...
XML External Entity Injection (XXE)
org.apache.tika, tika-parser-pdf-module is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of crafted XFA files inside PDFs, which allows an attacker to read sensitive data or trigger malicious requests to internal or third-party servers...
HPESBNW04940 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities
Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-47621 |...
The Cybersecurity of a Humanoid Robot
The rapid advancement of humanoid robotics presents unprecedented cybersecurity challenges that existing theoretical frameworks fail to adequately address. This report presents a comprehensive security assessment of a production humanoid robot platform, bridging the gap between abstract security...
WordPress plugin Quiz Maker SQL注入漏洞
WordPress Quiz Maker plugin is a WordPress plugin for creating online quizzes, exams and questionnaires with multiple question types and customization support. WordPress Quiz Maker plugin suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally...
The vulnerability of the addElement and addAttribute methods in the library for working with XML, XPath, and XSLT in dom4j allows attackers to perform XXE attacks.
The vulnerability of the addElement and addAttribute methods in the library for working with XML, XPath, and XSLT in dom4j is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...
Openfire < 5.0.2 / 5.1.0 Identity Spoofing
The remote host is running a version of Openfire that is affected by an identity spoofing vulnerability. Openfireâs SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1...
SUSE CVE-2023-53310
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, &fuelgaugedesc, &psycfg;...
CVE-2023-53310
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, gaugedesc, cfg; As soon ...
JasperReports has a Java deserialisation vulnerability
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...
GHSA-7C3F-CG9X-F3GR JasperReports has a Java deserialisation vulnerability
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...
CVE-2025-10492
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...
CVE-2025-10492
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...
CVE-2023-53310
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, &fuelgaugedesc, &psycfg;...
DEBIAN-CVE-2023-53310
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, &fuelgaugedesc, &psycfg;...
UBUNTU-CVE-2023-53310
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, &fuelgaugedesc, &psycfg;...
UBUNTU-CVE-2025-10492
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...
CVE-2023-53310 power: supply: axp288_fuel_gauge: Fix external_power_changed race
In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged dereferences info-bat, which gets sets in axp288fuelgaugeprobe like this: info-bat = devmpowersupplyregisterdev, &fuelgaugedesc, &psycfg;...