MongoDB -- crash due to improper validation of explain command

[email protected] reports: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to...

CVE-2024-45355

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

CVE-2024-45356

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3 (SUSE-SU-2025:1056-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1056-1 advisory. - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses bsc1233307. Tenable has...

CVE-2024-45356

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

CVE-2024-45356 Xiaomi phone framework has unauthorized access vulnerability

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

CVE-2024-45356

The CVE-2024-45356 entry concerns the Xiaomi phone framework. Affected software: Xiaomi phone framework. Root cause: improper validation allowing an attacker to access sensitive methods. Impact: unauthorized access to sensitive methods; CVSS vector indicates LOCAL attack vector, LOW integrity, HI...

CVE-2024-45356 Xiaomi phone framework has unauthorized access vulnerability

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

CVE-2024-45355 Xiaomi phone framework has unauthorized access vulnerability

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods...

CVE-2024-45355

The CVE-2024-45355 entry concerns the Xiaomi phone framework and describes an unauthorized access vulnerability caused by improper validation that can allow attackers to access sensitive methods. The available sources (NVD, Red Hat, CVE listing, etc.) identify the affected component as the Xiaomi...

PT-2025-13046 · Xiaomi · Xiaomi Phone Framework

Name of the Vulnerable Software and Affected Versions: Xiaomi phone framework affected versions not specified Description: A vulnerability exists due to improper validation, allowing attackers to access sensitive methods. This issue can be exploited to gain unauthorized access. Recommendations: A...

GHSA-V342-4XR9-X3Q3 Frappe has Possibility of Remote Code Execution due to improper validation

Impact A system user was able to create certain documents in a specific way that could lead to RCE. Workarounds There's no workaround, an upgrade is required. Credits Thanks to Thanh of Calif.io for reporting the issue...

Frappe has Possibility of Remote Code Execution due to improper validation

Impact A system user was able to create certain documents in a specific way that could lead to RCE. Workarounds There's no workaround, an upgrade is required. Credits Thanks to Thanh of Calif.io for reporting the issue...

CVE-2025-30213 Frappe has Possibility of Remote Code Execution due to improper validation

Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an...

Authentication Bypass

fast-jwt is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the iss claim, allowing an array of strings as a valid issuer, which can be exploited for JWT forgery and authentication bypass attacks...

CVE-2024-11850

A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...

CVE-2024-9597

A Path Traversal vulnerability exists in the /wipedatabase endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the key parameter, which is used to construct file paths. An attacker can exploit th...

CVE-2021-25635

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid or unknown to LibreOffice algorithm and LibreOffice would incorrectly present...

CVE-2024-11850 Stored XSS in langgenius/dify

A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...

CVE-2024-9920 Unrestricted File Upload and Execution in parisneo/lollms-webui

In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/openfile' API...