3396 matches found
DEBIAN-CVE-2025-2713
Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork...
UBUNTU-CVE-2025-2713
Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork...
PT-2025-13547
Name of the Vulnerable Software and Affected Versions: Google gVisor affected versions not specified Description: The issue is related to a local privilege escalation due to incorrect handling of file access permissions in Google gVisor's runsc component. This allowed unprivileged users to access...
CVE-2024-7767 Improper Access Control in danswer-ai/danswer
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...
CVE-2025-22228
BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...
LiteLLM 安全漏洞
LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A security vulnerability exists in LiteLLM versions prior to 1.44.12, which stems from the API key masking code masking only the first 5 characters, which could lead to API key disclosure...
Danswer 安全漏洞
Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. A security vulnerability exists in Danswer version v0.3.94, which stems from improper access control and allows the first user to view, modify, and delete...
CVE-2025-26485
A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts in case of the usage of a wrong password or a non existent user. The difference in the returned error messages could be used by attackers to understand whether a certain user is...
CVE-2025-29425
Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in examsave.php via the parameters member and first...
Online Class and Exam Scheduling System profile.php file cross-site scripting vulnerability
Online Class and Exam Scheduling System is an online class and exam scheduling system. A cross-site scripting vulnerability exists in Online Class and Exam Scheduling System, which stems from the lack of effective filtering and escaping of user-supplied data in the parameters memberfirst and...
Online Class and Exam Scheduling System exam_save.php File SQL Injection Vulnerability
Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameters member and first of...
CVE-2025-29427
Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting XSS in profile.php via the memberfirst and memberlast parameters...
CVE-2025-29425
Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in examsave.php via the parameters member and first...
CVE-2025-29425
Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in examsave.php via the parameters member and first...
e-Excellence U-Office Force 安全漏洞
e-Excellence U-Office Force is an e-Office platform from China-based First Class Technology e-Excellence. A security vulnerability exists in e-Excellence U-Office Force that stems from improper authentication, which could result in an unauthenticated remote attacker logging in as an administrator...
DRUPAL-CONTRIB-2025-023
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently ensure that known login routes are not overridden by third-party modules which can allow an access bypass to occur. This vulnerabili...
Embedded Malicious Code
Overview cdn-icon-fetcher-help is a Malicious package. Affected versions of this package are vulnerable to Embedded Malicious Code. Once this package is installed and executed, it downloads a Javascript file from a cdn-static-seven.vercel.app URL, which appears to be an image hosting site. Howeve...
Embedded Malicious Code
Overview cdn-icon-fetch is a Malicious package. Affected versions of this package are vulnerable to Embedded Malicious Code. Once this package is installed and executed, it downloads a Javascript file from a cdn-static-server.vercel.app URL, which appears to be an image hosting site. However, by...
AZL-57694 CVE-2024-45778 affecting package grub2 for versions less than 2.06-25
A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash...