17619 matches found
CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction
AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...
MAL-2025-47467 Malicious code in internallib_v52 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4d4bce17702fd04e9d38d97007a2bc8b4028c77159bcd19e1565f71d7f4ada4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-10458
Parameters are not validated or sanitized, and are later used in various internal operations...
CVE-2025-10458 Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values
Parameters are not validated or sanitized, and are later used in various internal operations...
CVE-2025-10458 Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values
Parameters are not validated or sanitized, and are later used in various internal operations...
PT-2025-38512
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description The software exhibits a flaw due to improper validation or sanitization of parameters. These parameters are subsequently utilized in internal operations,...
CVE-2025-57644
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write a...
PT-2025-38609
Name of the Vulnerable Software and Affected Versions Vasion Print Virtual Appliance Host versions prior to 25.2.169 Vasion Print Application versions prior to 25.2.1518 Description The Vasion Print Virtual Appliance and Application expose Docker internal networks, allowing attackers on the same...
PT-2025-38575
Name of the Vulnerable Software and Affected Versions AliasVault API versions 0.23.0 and lower Description A server-side request forgery SSRF vulnerability exists in the favicon extraction feature. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...
PT-2025-38600
Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments affected versions not specified Description Vasion Print formerly PrinterLogic utilizes Docker containers on shared internal networks lacking...
Zephyr 安全漏洞
Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in zephyr that stems from unvalidated or cleaned parameters that could lead to the exploitation of internal operations...
CVE-2025-37124
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruptio...
Server-Side Request Forgery (SSRF)
phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation because the setPath method in the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class allows attackers to craft requests to internal resources...
CVE-2025-59346
Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery SSRF vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CreatePreheat process and peer-to-peer communication mechanisms. An attacker can access internal network resources by supplying crafted URLs to API endpoints or by leveraging peer requests,...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CreatePreheat process and peer-to-peer communication mechanisms. An attacker can access internal network resources by supplying crafted URLs to API endpoints or by leveraging peer requests,...
Dragonfly vulnerable to server-side request forgery
Impact There are multiple server-side request forgery SSRF vulnerabilities in the DragonFly2 system. The vulnerabilities enable users to force DragonFly2’s components to make requests to internal services, which otherwise are not accessible to the users. One SSRF attack vector is exposed by the...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CreatePreheat process and peer-to-peer communication mechanisms. An attacker can access internal network resources by supplying crafted URLs to API endpoints or by leveraging peer requests,...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CreatePreheat process and peer-to-peer communication mechanisms. An attacker can access internal network resources by supplying crafted URLs to API endpoints or by leveraging peer requests,...
