PT-2025-11346

Name of the Vulnerable Software and Affected Versions PHP versions 8.1. through 8.1.31 PHP versions 8.2. through 8.2.27 PHP versions 8.3. through 8.3.18 PHP versions 8.4. through 8.4.4 Description The issue is related to the insufficient validation of end-of-line characters in user-supplied...

Codezips Project Management System SQL Injection Vulnerability (CNVD-2025-00978)

Codezips Project Management System is a project management system that provides project management, task assignment and other features. A SQL injection vulnerability exists in the /pages/forms/advanced.php file in Codezips Project Management System version 1.0, which stems from insufficient...

GHSA-J5VV-6WJG-CFR8 changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

Summary Improper input validation in the application can allow attackers to perform local file read LFR or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd o...

CVE-2020-9085

There is a NULL pointer dereference vulnerability in some Huawei products. An attacker may send specially crafted POST messages to the affected products. Due to insufficient validation of some parameter in the message, successful exploit may cause some process abnormal. Vulnerability ID:...

CVE-2024-11644

The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross-Site Scripting (XSS)

Piranha is vulnerable to a Cross-site scripting XSS. The vulnerability is due to insufficient validation of uploaded PDF files, allowing authenticated remote attackers to upload crafted files containing malicious JavaScript code that executes when a victim interacts with the file in their web...

Cross-Site Request Forgery (CSRF)

Avenwu Whistle is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation of API requests, allowing attackers to perform malicious API calls that result in arbitrary code execution on the victim's machine...

PT-2024-17755 · Delta Electronics · Drasimucad

Name of the Vulnerable Software and Affected Versions: Delta Electronics DRASimuCAD affected versions not specified Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit...

Insufficient Validation Of Integration Time

sigstore is vulnerable to insufficient validation of integration time. The vulnerability is due to insufficient validation of the integration time in "v2" and "v3" bundles, which allows an attacker to modify the timestamp and cause the signature verification to fail. However, the attack does not...

Denial Of Service (DoS)

drupal/core is vulnerable to denial of service DOS. The vulnerability is due to insufficient validation or rate-limiting of comment reply requests, allowing an attacker to overload the system...

File Manipulation

drupal/core is vulnerable to File Manipulation. The vulnerability is due to insufficient validation and sanitization of user-provided file paths, which can lead to unauthorized file access or manipulation...

IBM Carbon Design System Cross-Site Scripting Vulnerability

IBM Carbon Design System is a design system for building user interfaces. A cross-site scripting vulnerability exists in IBM Carbon Design System. The vulnerability stems from insufficient validation of user input. An attacker can exploit the vulnerability to embed arbitrary JavaScript code in th...

Apache Subversion Denial of Service Vulnerability (CNVD-2024-49153)

Apache Subversion is the United States Apache Apache Foundation of a set of open source version control system. The system is compatible with Concurrent Versions System CVS. A denial of service vulnerability exists in Apache Subversion 1.14.4 and earlier versions, which stems from insufficient...

Mozilla Thunderbird ESR Security Update (MFSA2024-69) - Windows

Mozilla Thunderbird ESR is prone to an insufficient validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Denial Of Service (DoS)

cosmossdk.io/math is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient bit-length validation in the sdk.Int and sdk.Dec types, which fails to properly enforce constraints, allowing unexpected conditions to cause a panic...

GHSA-HHFG-FWRW-87W7 sigstore has insufficient validation of integration timestamp during verification

Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...

BIT-SUBVERSION-2024-46901 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

PT-2024-10095 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to the Allow All File Extensions for file fields feature in Drupal, which affects the handling of file uploads. This vulnerability is associated with insufficient input...

CVE-2024-55655

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is...

CVE-2024-55655 sigstore-python has insufficient validation of integration timestamp during verification

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is...