13817 matches found
EUVD-2025-123461
Malicious code in prettier-cli-css-minimizer-webpack-plugin-node-sass npm...
EUVD-2025-116360
Malicious code in auth0-cli-envconfig-capella npm...
EUVD-2025-115297
Malicious code in cli-start-husky-pyxis npm...
PT-2026-6059
Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description An HTTP Request Smuggling issue exists in libsoup, an HTTP client/server library. The problem stems from non-RFC-compliant parsing within the soup filter input stream read line function,...
PT-2025-46688
Name of the Vulnerable Software and Affected Versions Xxl-api version 1.3.0 Description A stored cross-site scripting XSS issue exists in the Business Line Management module. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter...
CVE-2025-60646
A stored cross-site scripting XSS in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...
PT-2025-46713
Name of the Vulnerable Software and Affected Versions cups-filters versions prior to 1.28.18 Description cups-filters includes backends, filters, and other software needed for the CUPS printing service. A flaw exists where a specially crafted PDF file with a large MediaBox value can cause an...
CVE-2025-60646
A stored cross-site scripting XSS in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...
CVE-2025-60646
CVE-2025-60646 is a stored cross-site scripting (XSS) vulnerability in the Business Line Management module of Xxl-api v1.3.0. The issue arises from user-controllable input in the Name parameter, enabling an attacker to inject arbitrary web scripts or HTML. Affected software: Xxl-api (Business Lin...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990856)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990856 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from bo...
rack: Rack memory exhaustion denial of service
A denial of service flaw has been found in the rubygems rack package. Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line CRLFCRLF. The parser keeps appending incoming bytes to memory without a size cap, allowing...
UBUNTU-CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...
CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...
libtiff security update
4.0.9-36 - fix CVE-2025-8176: prevent skipping first line in tiffdither and tiffmedian tools RHEL-120230...
PT-2025-46190
Name of the Vulnerable Software and Affected Versions BusyBox versions through 1.3.7 Description The software accepts raw CR 0x0D/LF 0x0A and other C0 control bytes within the HTTP request-target path/query. This allows an attacker to split the request line and inject controlled headers...
BusyBox 安全漏洞
BusyBox is a suite of applications containing several linux commands and tools by the individual developer Denis Vlasenko in Ukraine. A security vulnerability exists in BusyBox 1.3.7 and earlier versions, which stems from the acceptance of C0 control bytes such as raw CR and LF in the target of a...
[SECURITY] Fedora 42 Update: xen-4.19.3-8.fc42
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...
The vulnerability of the jpegBase::readMetadata() function in the library and the command-line utility for managing image metadata from Exiv2 allows a attacker to cause a service failure.
The vulnerability of the jpegBase::readMetadata function in the Exiv2 library and command-line utilities for managing image metadata involves inefficient algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362
Cisco on Wednesday disclosed that it became aware of a new attack variant that's designed to target devices running Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software releases that are susceptible to CVE-2025-20333 and...
