CVE-2025-26355

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

PT-2025-7136

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A missing authentication issue for a critical function in maxprofile/menu/routes.lua allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests...

The vulnerability of the lua_resume component in the ldo.c script interpreter of Lua allows a hacker to cause a service failure.

The vulnerability of the luaresume component in the ldo.c script interpreter of Lua is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2025-7155

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/setup/routes.lua file. This allows an unauthenticated remote attacker to disable front panel...

PT-2025-7137

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as SQL Injection. This occurs in the maxprofile/menu/model.lua file, specifically a...

Q-Free MAXTIME Suite 安全漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions that stems from a missing authorization in maxprofile/users/routes.lua. An attacker could exploit the vulnerability t...

PT-2025-7150

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to missing authentication for a critical function in maxprofile/setup/routes.lua, allowing an unauthenticated remote attacker to factory reset the device via crafted...

PT-2025-7148

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/accounts/routes.lua file. This allows an unauthenticated remote attacker to reset user PINs via...

Q-Free MAXTIME Suite 访问控制错误漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. An access control error vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions, which stems from a lack of authentication for critical functions in maxprofile/setup/routes.lua. An...

Q-Free MAXTIME Suite 访问控制错误漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. An access control error vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions, which stems from a lack of authentication for critical functions in maxprofile/menu/routes.lua. An...

Azure Linux 3.0 Security Update: redis / valkey (CVE-2024-46981)

The version of redis / valkey installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46981 advisory. - Redis is an open source, in-memory database that persists on disk. An authenticated user May use a...

Azure Linux 3.0 Security Update: lua / nmap / ntopng (CVE-2022-33099)

The version of lua / nmap / ntopng installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-33099 advisory. - An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow...

CVE-2021-43519 affecting package lua for versions less than 5.4.4-1

CVE-2021-43519 affecting package lua for versions less than 5.4.4-1. A patched version of the package is available...

CVE-2020-15945 affecting package lua for versions less than 5.4.0-1

CVE-2020-15945 affecting package lua for versions less than 5.4.0-1. A patched version of the package is available...

CVE-2022-28223

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin...

CVE-2024-31446

OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device ...

tarantool:lua_load_test: Heap-buffer-overflow in lj_strfmt_pushvf

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=6397285907103744 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: lualoadtest Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...

Updated redis packages fix security vulnerabilities

Redis' Lua library commands may lead to remote code execution. CVE-2024-46981 Redis allows denial-of-service due to malformed ACL selectors. CVE-2024-51741...

MGASA-2025-0033 Updated redis packages fix security vulnerabilities

Redis' Lua library commands may lead to remote code execution. CVE-2024-46981 Redis allows denial-of-service due to malformed ACL selectors. CVE-2024-51741...

ROS-20250203-12

A vulnerability in the ldebug.c component of the Lua script interpreter involves an integer loss of significance. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...