9704 matches found
CVE-2025-24358
gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...
CVE-2025-29471
A stored Cross-Site Scripting (XSS) vulnerability exists in Nagios Log Server version 2024R1.3.1 and below. The flaw allows a low-privileged user to inject malicious JavaScript into the email field of their profile. When an administrator views the audit logs, the payload executes, enabling the at...
CVE-2025-32996
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...
CVE-2025-33026
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...
CVE-2025-33027
CVE-2025-33027 concerns Bandizip up to version 7.37 where a Mark-of-the-Web bypass exists in the handling of archived files. When extracting crafted archives bearing MoW, Bandizip fails to propagate the marker to extracted files, potentially allowing arbitrary code execution in the current user c...
CVE-2024-49200
An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. Th...
CVE-2025-28136
The TOTOLINK A800R wireless router, specifically version V4.1.2cu.5137_B20200730 , contains a stack-based buffer overflow vulnerability in the downloadFile.cgi function. The root cause is a failure to properly validate the length of input data, leading to memory reading beyond buffer boundaries. ...
CVE-2025-31494 AutoGPT allows cross-user sharing of node execution results through WebSockets API
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graphid+graphversion. Additionally, there was no che...
CVE-2022-43840
creationtimestamp| type| source ---|---|--- 2025-04-14 20:54:32+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11699 2025-04-14 22:38:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmsmvtzoj62i 2025-04-15 01:32:48+00:00| seen| https://t.me/cvedetector/22894...
CGA-RXQC-7C89-C6H7
Bulletin has no description...
CVE-2025-2424
creationtimestamp| type| source ---|---|--- 2025-04-14 16:33:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmryimatkb2r 2025-04-14 18:51:33+00:00| seen| https://t.me/cvedetector/22874...
CGA-9M6F-8G89-5VXR
Bulletin has no description...
CVE-2025-2161
creationtimestamp| type| source ---|---|--- 2025-04-14 14:54:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11630 2025-04-14 17:02:16+00:00| seen| Telegram/OFuRR0civy3slRsbeYmtpiy7fl08jVMyZ8fXlQ6z9u1Umw 2025-04-14 18:51:32+00:00| seen| https://t.me/cvedetector/22873 2025-04-15...
CVE-2025-3559
creationtimestamp| type| source ---|---|--- 2025-04-14 09:53:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11593 2025-04-14 12:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmrl33zh632u 2025-04-14 12:59:43+00:00| seen|...
CVE-2025-31344
A flaw was found in the gif2rgb utility of giflib. This vulnerability allows an attacker to cause a heap-based buffer overflow via crafted GIF files. The issue arises due to improper handling of certain GIF image data, leading to memory corruption. Mitigation Mitigation for this issue is either...
Important: Red Hat Security Advisory: gvisor-tap-vsock security update
An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...
CVE-2025-3555 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The...
CVE-2025-2814
creationtimestamp| type| source ---|---|--- 2025-04-13 00:51:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11553 2025-04-13 03:33:14+00:00| seen| https://t.me/cvedetector/22801 2025-04-13 04:17:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmo6vvjxhb2l...