CVE-2022-45748

creationtimestamp| type| source ---|---|--- 2025-04-03 15:34:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10246...

AZL-77514 CVE-2025-30204 affecting package keda for versions less than 2.4.0-32

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2025-24440

Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Fortinet FortiSandbox 操作系统命令注入漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from US-based Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting, and more. An operating system command injection vulnerability exists ...

Linux Distros Unpatched Vulnerability : CVE-2020-25645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt...

PT-2025-7515 · WordPress · Wp-Appbox

Name of the Vulnerable Software and Affected Versions: WP-Appbox plugin for WordPress versions up to, and including, 4.5.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's appbox shortcode due to insufficient input sanitization and output escaping on user-supplied...

WordPress Easy Booked Plugin <= 2.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by l8BL Patchstack Alliance in WordPress Plugin Easy Booked – Appointment Booking and Scheduling Management System for WordPress versions = 2.4.5...

CVE-2024-45290

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided...

CVE-2025-0974

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-24010 Vite allows any websites to send any requests to the development server and read the response

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and...

ETIC Telecom Remote Access Server 安全漏洞

ETIC Telecom Remote Access Server is a remote maintenance solution from the French company ETIC Telecom. It is designed to enable manufacturers to maintain automated equipment remotely. A security vulnerability exists in ETIC Telecom Remote Access Server versions prior to 4.5.0, which stems from...

PT-2024-36606 · Ibm · Ibm Powerha Systemmirror

Name of the Vulnerable Software and Affected Versions: IBM PowerHA SystemMirror for i versions 7.4 through 7.5 Description: The issue is related to improper restrictions when rendering content via iFrames, which could allow an attacker to gain improper access and perform unauthorized actions on t...

AZL-54692 CVE-2024-56738 affecting package grub2 2.06-16

GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...

PT-2024-36014 · Hewlett Packard · Hpe Alletra Storage Mp B10000

Name of the Vulnerable Software and Affected Versions: HPE Alletra Storage MP B10000 versions prior to 10.4.5 Description: A remote authentication bypass issue affects the HPE Alletra Storage MP B10000, allowing disclosure of information. This issue can be remotely exploited. Recommendations: For...

HPESBST04764 rev.1 - HPE Alletra MP OS, Remote Authentication Bypass Vulnerability

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Alletra Storage MP B10000 - Prior to v10.4.5 HPE GreenLake for Block Storage MP OS - Prior to v10.4.5 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

CVE-2024-53143 fsnotify: Fix ordering of iput() and watched_objects decrement

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput and watchedobjects decrement Ensure the superblock is kept alive until we're done with iput. Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotif...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.5.1...

Malicious Embedded Code

Overview ultralytics is an Ultralytics YOLOv8 for SOTA object detection, multi-object tracking, instance segmentation, pose estimation and image classification. Affected versions of this package are vulnerable to Malicious Embedded Code. These versions have been compromised to install an xmrig...

PT-2024-9572 · Ibm · Ibm Watson Speech Services Cartridge For Ibm Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data versions 4.0.0 through 5.0.2 Description: The issue is caused by synchronization errors when using a shared resource, potentially allowing a remote attacker to cause a denial of...

AZL-52266 CVE-2024-51744 affecting package prometheus for versions less than 2.37.9-4

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...