chuanhuchatgpt 跨站脚本漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An HTML injection vulnerability exists in chuanhuchatgpt version 20b2e02, which stems from improper HTML tag cleanup in chat history uploads,...

CLSA-2025-1742319076 Fix CVE(s): CVE-2023-44487

SECURITY UPDATE: The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly - debian/patches/CVE-2023-44487.patch: HTTP/2 - per-iteration stream handling limit. - CVE-2023-44487...

The vulnerability of the OData protocol implementation in the SAP Fiori for SAP ERP business application platform allows a attacker to perform a cache poisoning attack or intercept sessions.

The vulnerability of the OData protocol implementation in SAP Fiori for SAP ERP business application development platforms is related to deficiencies in handling HTTP header requests. Exploiting this vulnerability allows a malicious actor to perform a cache poisoning attack or intercept sessions ...

UpdraftPlus plugin’s vulnerability: The WP Backup & Migration system for WordPress content management system, which allows attackers to inject a PHP object into the system.

UpdraftPlus plugin’s vulnerability: The WP Backup & Migration system of the WordPress content management system is vulnerable due to shortcomings in the deserialization mechanism. Exploiting this vulnerability allows an attacker to inject a PHP object remotely...

Fixed vulnerabilities in FortiOS, FortiProxy, FortiPAM, FortiSRA and FortiWeb.

Fortinet has fixed a vulnerability in FortiOS, FortiProxy, FortiPAM, FortiSRA and FortiWeb. The vulnerability is in how certain Fortinet products handle HTTP and HTTPS requests. A malicious party with certain privileges can send specially crafted requests that lead to the execution of unauthorize...

JetBrains Ktor 环境问题漏洞

JetBrains Ktor is a web framework for building asynchronous servers and clients in Kotlin from the Czech company JetBrains. Used to create microservices, Web applications , etc., build RESTful API. JetBrains Ktor suffers from a security vulnerability that stems from the occurrence of an HTTP...

CVE-2024-45324

A use of externally-controlled format string vulnerability CWE-134 in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0...

The vulnerability of TP-LINK TL-WR841ND router’s microprogramming software lies in the fact that the operation output goes beyond the buffer in memory, allowing a hacker to cause a malfunction in the device.

The vulnerability of TP-LINK’s TL-WR841ND router’s microprogramming software lies in the fact that the operation is performed outside the buffer in memory when processing the ssid parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending specially craft...

net/http: Denial of service due to improper 100-continue handling in net/http

A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service...

CVE-2025-27424

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for iOS 136...

libhv 环境问题漏洞

libhv is an open source network library by ithewei that is easier to use than libevent/libuv/asio. An environment issue vulnerability exists in libhv 1.3.3 and earlier versions, which stems from inconsistent HTTP request interpretation and may result in HTTP response entrapment...

The vulnerability of the user.bin file in the Digma A172 mobile phone’s firmware, related to deficiencies in generating HTTP requests, allows for network activities without user involvement.

The vulnerability of the user.bin file in Digma A172 mobile phone software relates to deficiencies in the generation of HTTP requests. Exploiting this vulnerability allows a remote attacker to perform network activities without the user’s involvement...

CyberArk Endpoint Privilege Manager 安全漏洞

CyberArk Endpoint Privilege Manager is a privilege management software from the Israeli company CyberArk. The software includes features such as privilege management, application control and credential loss protection. A security vulnerability exists in CyberArk Endpoint Privilege Manager version...

The vulnerability of the HTTP protocol implementation in the software products of the LLC “NPO “MIR” lies in the transmission of data in an open manner, which allows attackers to disclose protected information.

The vulnerability of the HTTP protocol implementation in software products of the LLC “NPO ‘MIR’” lies in the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

UBUNTU-CVE-2025-26803

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

Phusion Passenger 安全漏洞

Phusion Passenger is a fast and powerful web server and application server from Phusion Open Source. A security vulnerability exists in Phusion Passenger versions 6.0.21 through 6.0.25 that originates in a denial of service when the HTTP parser resolves an invalid HTTP method...

The vulnerability of the task and project management service WEEEK, related to the failure to implement measures for eliminating HTML tags, allows a violator to execute arbitrary HTML code.

The vulnerability of the WEEEK task and project management service is related to the lack of measures taken to eliminate HTML tags. Exploiting this vulnerability could allow a remote attacker to execute arbitrary HTML code...

CVE-2024-49337

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field...

PT-2025-7300 · Phpjabbers · Phpjabbers Restaurant Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Restaurant Booking System version 3.0 Description: The issue concerns multiple HTML injection vulnerabilities in the parameters name, plugin sms api key, plugin sms country code, and title. This allows for potential malicious HTML...

DEBIAN-CVE-2025-1426

Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...