1043 matches found
CVE-2021-22302
There is an out-of-bound read vulnerability in Taurus-AL00A 10.0.0.1C00E1R1P1. A module does not verify the some input. Attackers can exploit this vulnerability by sending malicious input through specific app. This could cause out-of-bound, compromising normal service...
CVE-2019-18608
Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...
CVE-2020-7002
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be exploited when a valid user opens a specially crafted, malicious input file...
CVE-2024-39882
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current proce...
Heap-based Buffer Overflow
MLX is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to a 13-byte out-of-bounds read when parsing malicious NumPy .npy files, where an attacker-controlled file causes a crash or information disclosure, and attackers can exploit this by crafting malicious .npy files to gain...
SUSE CVE-2025-14087
A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...
CVE-2025-14087
A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...
CVE-2025-61729
CVE-2025-61729 is a DoS in Go components exposed by crafted certificates, tied to excessive resource consumption from unbounded error string construction (HostnameError.Error) and related quadratic runtime. Multiple advisories (ALSA and container tooling) reference this CVE as a security fix targ...
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Summary A DoS can occur that immediately halts the system due to the use of an unsafe function. Details According to RFC 5322, nested group structures a group inside another group are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested...
kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
A flaw out of boundary read in the Linux kernel NFS functionality was found in the way connected user sends malicious data to the server. A remote user could use this flaw to crash the system...
EUVD-2025-93537
NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...
CVE-2025-23361
CVE-2025-23361 affects NVIDIA NeMo Framework. A vulnerability in a script allows malicious input to control code generation, with potential code execution, privilege escalation, information disclosure, and data tampering. Affected product: NVIDIA NeMo Framework (version context shows 2.0.3 in one...
NVIDIA Nemo Framework 代码注入漏洞
NVIDIA Nemo Framework is a framework for building and deploying generative AI models from NVIDIA. A code injection vulnerability exists in the NVIDIA Nemo Framework that stems from malicious input that could lead to improper control of code generation, which could result in code execution,...
PT-2025-46373
Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Framework affected versions not specified Description The NVIDIA NeMo Framework contains a flaw in a script that could allow an attacker to manipulate code generation with malicious input. Exploitation of this issue may result in...
CVE-2025-64442
HumHub (Open Source Enterprise Social Network) versions before 1.17.4 are affected by a cross-site scripting (XSS) vulnerability in the Meta-Search feature, allowing malicious input to execute in search previews. The issue is fixed in version 1.17.4. Impact is consistent with XSS (information dis...
CVE-2025-63639
The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting XSS due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing th...
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
Impact This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly...
CVE-2025-60280
Cross-Site Scripting XSS vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly i...
EUVD-2025-33881
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery SSRF. An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server...