7801 matches found
Chuanhu Chat - Directory Traversal
The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...
QNAP Music Station < 5.4.0 - Authentication Bypass
An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...
Sonatype Nexus Repository Manager 3 - Local File Inclusion
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. id: CVE-2024-4956 info: name: Sonatype Nexus Repository Manager 3 - Local File Inclusion author: ritikchaddha severity: high description: | Path Traversal in Sonatype...
XWiki DeleteApplication - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...
CVE-2019-10172
CVE-2019-10172 https://vulners.com/cve/CVE-2019-10172 There is no known non-vulnerable version of this component/package. It is recommended to investigate alternative components or a potential mitigating control. Mitigation 1. Desirable Try to switch from usage of com.codehaus.jackson to...
bigint-buffer-js
bigint-buffer-js Drop-in replacement for [email protected] without the native binding. bigint-buffer ≤ 1.1.5 has a buffer overflow in the native toBigIntLE CVE-2025-3194 / GHSA-3gc7-fjrx-p6mg and no fixed version has been published. It is pulled in transitively by @solana/buffer-layout-utils...
ROOT-OS-UBUNTU-2204-CVE-2025-36423 CVE-2025-36423 in linux - Patched by Root
Root has patched CVE-2025-36423 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
rsyslog-librelp-CVE-2018-1000140-fixed
This repository does not have a README...
EUVD-2026-8832
Ajenti has potential Remote Code Execution...
ROOT-APP-PYPI-CVE-2026-34515 CVE-2026-34515 in aiohttp - Patched by Root
Root has patched CVE-2026-34515 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
Astra Linux – Vulnerability in Tomcat9
There is a vulnerability related to improper input validation in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, and 10.0.0-M1 through 10.0.27. Older, end-of-support versions may also be affected...
Astra Linux – vulnerability in node-minimatch
Minimatch is a minimal matching utility designed to convert glob expressions into JavaScript RegExp objects. Versions 10.2.0 and earlier are vulnerable to Regular Expression Denial of Service ReDoS when a glob pattern contains multiple consecutive wildcards followed by a literal character that do...
Astra Linux – vulnerability in cups
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connected to cupsd but sent slow messages—for example, only one byte per second—would delay the entire operation of cupsd, rendering it unusable to other...
Astra Linux – Vulnerability in Waitress
Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...
Astra Linux – vulnerability in ruby2.5, jruby
A ReDoS issue was found in the Time component within Ruby versions up to 0.2.1 and 3.2.1. The Time parser fails to handle invalid URLs containing certain characters. This results in increased execution time when parsing strings into Time objects. The fixed versions are 0.1.1 and 0.2.2...
Astra Linux – vulnerability in gst-plugins-good1.0
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-samples to accommodate stream-nsamples + samplescount elements of type QtDemuxSample. The issue arises because samplescount is read from the input file; ...
Astra Linux - vulnerability in poppler, poppler-22
Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Since std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 fixes this issue...
Astra Linux – vulnerability in squid
An over-read of a buffer was found in libntlmauth in Squid versions 2.5 through 5.6. Due to improper integer overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In certain configurations, plaintext credentials stored at these locatio...
Astra Linux – Vulnerability in python-urllib3
urllib3 is a user-friendly HTTP client library for Python. Previously, urllib3 would not remove the HTTP request body when an HTTP redirect response was received using status 301, 302, or 303 after the request’s method changed from one that could accept a request body such as POST to GET, as...