3147 matches found
CVE-2025-21958
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovsctsetlabels is only called for confirmed conntrack entries ct within ovsctcommit. However, if the conntrack entry does not have the labelsext...
CVE-2025-21958
CVE-2025-21958 affects the Linux kernel with an OVS/conntrack interaction. The issue arises from reverting a prior change to per-action label counting in conntrack, causing ovs_ct_set_labels() to be called only for confirmed conntrack entries. If a conntrack entry lacks the labels_ext extension, ...
CVE-2025-21958
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovsctsetlabels is only called for confirmed conntrack entries ct within ovsctcommit. However, if the conntrack entry does not have the labelsext...
CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter
The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...
PT-2025-14086 · WordPress · Groundhogg
Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for Wordpress versions up to, and including, 3.7.4.1 Description: The issue is related to Stored Cross-Site Scripting via the label parameter due to insufficient input sanitization and output escaping. This allows...
CVE-2025-1267: Improper Neutralization of Input During Web Page Generation
The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...
WS-2022-0281
Network Policies & Clusterwide Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels...
Cross-site Scripting (XSS)
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Label argument. An attacker can inject malicious scripts by crafting a specially formatted input that exploits the improper...
PT-2025-13643
Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A vulnerability has been found in ConcreteCMS, affecting an unknown function of the component Switch Language Block Handler. The manipulation of the Label argument leads to cross-site scripting. It ...
Improper Encoding or Escaping of Output
Overview django-tomselect is a Django autocomplete widgets and views using Tom Select Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in form widget input, including the labelfield parameter. An attacker can hide the contents between tags in code from...
CVE-2025-30163
CVE-2025-30163 affects Cilium’s node-based network policies: policies using fromNodes/toNodes may incorrectly permit traffic to/from non-node endpoints sharing the same labels. Affected versions are Cilium v1.16.0–v1.16.7 and v1.17.0–v1.17.1; the issue is fixed in v1.16.8 and v1.17.2. Root cause:...
CVE-2025-30163
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies "fromNodes" and "toNodes" will incorrectly permit traffic to/from non-node endpoints that share the labels specified in "fromNodes" and "toNodes" sections of network policies. No...
The vulnerability of the nfs4_set_security_label() function in the fs/nfs/nfs4proc.c module of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the nfs4setsecuritylabel function in the fs/nfs/nfs4proc.c module of the Linux kernel is related to improper memory release before deleting the last reference memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2025-0433: Improper Neutralization of Input During Web Page Generation
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...
CVE-2024-9618: Improper Neutralization of Input During Web Page Generation
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output...
Exploit for Cross-site Scripting in Humansignal Label_Studio
CVE-2025-25296 Proof of Concept POC Description This pr...
SUSE CVE-2022-49115
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix misused goto label Fix a misused goto label jump since that can result in a memory leak...
DEBIAN-CVE-2022-49418
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...
UBUNTU-CVE-2022-49418
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...