3193 matches found
Linux Distros Unpatched Vulnerability : CVE-2023-30549
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer 1.1.0 and...
CVE-2025-8742
CVE-2025-8742 affects macrozheng mall 1.0.3, specifically the Admin Login component. The root cause is improper restriction of excessive authentication attempts, enabling remote exploitation. Documents note the attack requires high complexity and that exploitation is difficult, with vendor not re...
GHSA-HH28-H22F-8357 OpenBao has a Timing Side-Channel in the Userpass Auth Method
Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...
GHSA-J3XV-7FXP-GFHX OpenBao Userpass and LDAP User Lockout Bypass
Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. Patches OpenBao v2.3.2 will patch this issue. Workarounds Existing user...
CVE-2025-7954
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations...
The vulnerability of the user blocking mechanism of the Vault Enterprise and Vault Community Edition corporate information archiving platforms allows attackers to circumvent existing security restrictions.
The vulnerability of the user blocking mechanism in the Vault Enterprise and Vault Community Edition corporate information archiving platforms is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security...
PT-2025-32381
Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was...
Yealink IP Phones and RPS (Redirect and Provisioning Service)
RISK EVALUATION Successful exploitation of these vulnerabilities could result in an information disclosure. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system...
CVE-2025-50422
A PDF parsing flaw has been discovered in poppler. This flaw may allow an attacker who can craft a malicious pdf file to induce a crash if they can convince their target to open the crafted pdf. Mitigation Mitigation for this issue is either not available or the currently available options do not...
CVE-2025-7954 Race Condition in Shopware Voucher Submission
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations...
CVE-2025-6015
Vault and Vault Enterprise’s “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
apache-commons-fileupload: Apache Commons FileUpload DoS via part headers
A denial-of-service DoS vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number...
tomcat: Apache Tomcat DoS in multipart upload
A denial-of-service DoS vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger...
tomcat: Apache Tomcat denial of service
A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits...
tomcat: Apache Tomcat DoS in multipart upload
A denial-of-service DoS vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger...
tomcat: Apache Tomcat denial of service
A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits...
Maka GPS Marbella KR8s 安全漏洞
Maka GPS Marbella KR8s is a car recorder from Maka GPS Singapore. A security vulnerability exists in Maka GPS Marbella KR8s version 2.0.8, which stems from default credentials and short password restrictions...
The vulnerability of the Blitz Identity Provider software lies in its insufficient limit on authentication attempts. This allows a perpetrator to register an email account to which they have no access and then verify it.
The vulnerability of the Blitz Identity Provider software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to register a mail account that they do not have access to and then verify it...