4026 matches found
CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges access to the site's source code or a CMS plugin to enter a URL containing an insecure scheme such as javascript:alert. Before the fix, URL...
CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions width and height were not properly validated. This allowed an attacker with direct access to the site's source code...
CVE-2025-30373
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP...
CVE-2025-30373
CVE-2025-30373 affects Graylog (Graylog2-server) starting with version 6.1, where HTTP Inputs can be configured to require a header/value for authentication. The flaw: when the required header is missing or has an incorrect value, the system returns HTTP 401 but ingests the message anyway, effect...
CVE-2025-30373 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP...
CVE-2025-30373 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP...
CVE-2025-32364
A flaw was found in Poppler. This vulnerability allows a denial of service application crash via malformed input that triggers a floating-point exception involving INTMIN. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...
libvips 安全漏洞
libvips is a fast image processing library with low memory requirements from the libvips open source. A security vulnerability exists in versions of libvips prior to 8.16.1, which stems from misjudging the alpha channel when processing multiband inputs, and may result in a heap buffer overflow...
UBUNTU-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
CVE-2025-30373: Improper Authorization
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP...
tarteaucitron.js 安全漏洞
tarteaucitron.js is a cookie manager for the Amauri CHAMPEAUX individual developer. A security vulnerability exists in tarteaucitron.js versions prior to 1.20.1, which stems from insufficient validation of inputs to the addOrUpdate function and could lead to prototype contamination...
PT-2025-15235
Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.20.1 Description A vulnerability was identified in tarteaucitron.js where user-controlled inputs for element dimensions width and height were not properly validated. This allowed an attacker with direct...
CVE-2024-11235
A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the set magic method or the null coalescing assignment ??= operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout...
CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
DEBIAN-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
CVE-2025-32364
Poppler before 25.04.0 is affected by CVE-2025-32364 due to a floating-point exception in PSStack::roll, which may crash applications when handling malformed inputs involving INT_MIN. Upstream remediation is to upgrade to 25.04.0 or newer; multiple distributions have issued fixes (e.g., Mageia, F...
