7485 matches found
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the hashmapgetwithhash function in the gumbo-parser/src/hashmap.c file. An attacker can cause a crash or disrupt service by providing crafted input. Note: According to the maintainer of the package the cod...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the hashmapsetwithhash function in the gumbo-parser/src/hashmap.c file. An attacker can cause a crash or disrupt service by providing crafted input. Note: According to the maintainer of the package the cod...
DEBIAN-CVE-2025-48945
pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS...
AZL-67074 CVE-2025-48945 affecting package python3-pycares 4.5.0-1
pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS...
Arbitrary Code Injection
Overview org.webjars.npm:jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on th...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the H5FSsectfindnode function. An attacker can execute arbitrary code or cause a denial of service by providing specially crafted input that triggers a heap-based buffer overflow. Remediation A fix was...
Out-of-Bounds
Overview Affected versions of this package are vulnerable to Out-of-Bounds via the H5Creconstructcacheentry function in the file H5Cimage.c. An attacker can execute arbitrary code, cause a denial of service, or potentially alter data by providing crafted input that triggers a heap-based overflow...
WordPress ANON::form embedded secure form plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin ANON::form embedded secure form versions = 1.7...
WordPress File Manager Pro plugin <= 1.8.8 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin File Manager Pro versions = 1.8.8...
WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Elementor Website Builder versions = 3.29.0...
WordPress Gutenverse News plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via elementId Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons versions = 1.0.4...
WordPress Wise Chat plugin <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability
Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin Wise Chat versions = 3.3.4...
WordPress YITH WooCommerce Wishlist plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin YITH WooCommerce Wishlist versions = 4.5.0...
WordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Frissi0n in WordPress Plugin Integration for Contact Form 7 and Zoho CRM, Bigin versions = 1.3.0...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer is a library for constructing graphs of media-handling components. The function qtdemuxparsesbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability has been fixed in version 1.24.10...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer is a library for constructing graphs of media-handling components. A OOB-read vulnerability has been identified in the gstavisubtitleparsegab2chunk function within gstavisubtitle.c. This function reads the namelength value directly from the input file without properly checking it. As a...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-samples to accommodate stream-nsamples + samplescount elements of type QtDemuxSample. The problem is that samplescount is read from the input file. If th...
Weak Password Requirements
Overview Affected versions of this package are vulnerable to Weak Password Requirements due to support of clear-text passwords. An attacker can brute-force a shorter password to get access to the system. Note: OpenC3 supports authentication using an authentication token, users are advised to use ...
PT-2025-35976
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the drm/xe subsystem related to DMA fence handling. The driver may free data pointed to by DMA fences before all references are released,...