CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

GL.iNet Beryl AX GL-MT3000 安全漏洞

GL.iNet Beryl AX GL-MT3000 is a portable WiFi 6 router from China's Guanglian Zhitong GL.iNet. It is used to provide network connectivity and supports 2.5G network ports and a variety of features. A security vulnerability exists in GL.iNet Beryl AX GL-MT3000 version v4.7.0, which stems from...

CVE-2025-25685

An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25685

CVE-2025-25685 affects GL.iNet Beryl AX GL-MT3000 (v4.7.0). The issue allows attackers to download arbitrary files from the device’s filesystem by adding symbolic links on an external drive that is exposed as a Samba share. Root cause described is related to the handling of symbolic links on the ...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25684

CVE-2025-25684 affects GL.iNet Beryl AX GL-MT3000 (v4.7.0). A lack of validation in the /download path permits arbitrary file download from the device via a crafted POST request. Public references in the dataset confirm the vulnerability class as a path-traversal-like flaw enabling access to the ...

CVE-2025-25685

An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share...

GL.iNet Beryl AX GL-MT3000 安全漏洞

GL.iNet Beryl AX GL-MT3000 is a portable WiFi 6 router from China's Guanglian Zhitong GL.iNet. It is used to provide network connectivity and supports 2.5G network ports and a variety of features. A security vulnerability exists in GL.iNet Beryl AX GL-MT3000 version v4.7.0, which stems from...

Malicious code in gl-emoji-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbf0085827239922ce13937a55f76a51d8017ed351ca34e30214b10670b558a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2385 Malicious code in gl-emoji-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbf0085827239922ce13937a55f76a51d8017ed351ca34e30214b10670b558a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2024-57973

In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl-totlen" variable is controlled by the user. It comes from processresponses. On 32bit systems, the "gl-totlen + sizeofstruct cplpassacceptreq + sizeofstruct rssheader...

CVE-2024-35627

tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key...

GHSA-RHX6-C78J-4Q9W vulnerabilities

Vulnerabilities for packages: tileserver-gl, arangodb, grafana-image-renderer, argo-workflows, thingsboard, sqlpad, tileserver-gl-fips, kubeflow-pipelines, kubeflow-centraldashboard...

CVE-2024-21538 vulnerabilities

Vulnerabilities for packages: kibana, ts-patch, opensearch-dashboards, node-gyp, opensearch-dashboards-fips, tileserver-gl, arangodb, kubeflow-katib, lerna, airflow, argo-workflows, eslint, sqlpad, graalvm, pgadmin4, tileserver-gl-fips, renovate, py3-captum...

CVE-2024-10503

A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-10503 Klokan MapTiler tileserver-gl URL cross site scripting

A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-10503

CVE-2024-10503 affects Klokan MapTiler tileserver-gl 2.3.1. The vulnerability is in the URL Handler component where manipulation of the key parameter enables cross-site scripting. Exploitation is possible remotely; disclosures exist but details on a fixed version are not provided in the documents...

CVE-2024-10503 Klokan MapTiler tileserver-gl URL cross site scripting

A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

TileServer GL 跨站脚本漏洞

TileServer GL is an open source map server for vector blocks from the Maptiler team. A cross-site scripting vulnerability exists in TileServer GL version 2.3.1, which stems from a parameter key of the component URL Handler can lead to cross-site scripting attacks...