CVE-2025-21469

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call...

Qualcomm Chipsets 访问控制错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. An access control error vulnerability exists in Qualcomm Chipsets, which stems from a memory corruption caused by an input buffer length of zero in the IOCTL call when processing image encoding...

estree-util-value-to-estree allows prototype pollution in generated ESTree

Impact When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. Example: js import generate from 'astring' import valueToEstree from 'estree-util-value-to-estree' const estree = valueToEstree 'proto': const code...

Qualcomm Chipsets 代码问题漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A code issue vulnerability exists in Qualcomm Chipsets that stems from a memory corruption that occurs when processing IOCTL calls...

CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

ASTEVAL 安全漏洞

ASTEVAL is an open source library from lmfit that uses the ast module for parsimony evaluation of python expressions. A security vulnerability exists in ASTEVAL versions prior to 1.0.6, which stems from If an attacker has control over the inputs to the asteval library, it is possible to bypass...

CVE-2025-0221

A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function 0x22200c in the library pffilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached...

DEBIAN-CVE-2024-53203

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential array underflow in ucsiccgsynccontrol The "command" variable can be controlled by the user via debugfs. The worry is that if conindex is zero then "&uc-ucsi-connectorconindex - 1" would be an array...

BIT-NODE-MIN-2022-21824

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

CVE-2024-9692

CVE-2024-9692 affects VIMESA VHF/FM Transmitter Blue Plus (version 9.7.1). The vulnerability is an Improper Access Control (CWE-284) that allows an unauthenticated remote attacker to send an unauthorized HTTP GET request to the unprotected doreboot endpoint, causing a DoS by restarting transmitte...

GHSA-M6FV-JMCG-4JFG send vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

PT-2025-2513 · Qualcomm · Qualcomm Embedded Platform Microcode

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform microcode affected versions not specified Description: The issue is related to the hab ioctl function in Qualcomm's microcode, which is vulnerable to a buffer overflow in memory. This can lead to the disclosure of...

Google Pixel Security Breach

Google Pixel is a smartphone from Google, Inc. in the United States. Google Pixel suffers from a security vulnerability that stems from a type confusion in the aocunlockedioctl method of the aoc.c file could lead to memory corruption...

Regular Expression Denial Of Service (ReDoS)

mathjax is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists due to inefficient regular expression complexity in the components and markdown patterns, which allows an attacker to slow down the application if they can control the input to the MathJax.Message.Set or...

Cmcm Drivergenius 缓冲区错误漏洞

Cmcm Drivergenius Driver Genius is a software for Windows system to solve the driver adaptation update and download from China Beijing Cheetah Mobile Technology Co Ltd Cmcm company. A security vulnerability exists in Cmcm Drivergenius version 9.70.0.346, which originates from a problem with the...

SAP NetWeaver AS Input Validation Error Vulnerability (CNVD-2023-28124)

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS suffers from an input validation error vulnerability, which stems from faulty input control and can be exploited by an attack...

UBUNTU-CVE-2023-28339

OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made unavailable in the Linux kernel 6.2 and later...