2474 matches found
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash...
CVE-2025-25213
The CVE-2025-25213 issue affects Inaba Denki Sangyo Co., Ltd. Wi‑Fi AP UNIT AC-WPS-11ac series (affected versions include v2.0.03P and prior). Root cause: improper restriction of rendered UI layers or frames, enabling unintended operations when a logged‑in user views/clicks on content hosted on a...
webkitgtk: Processing maliciously crafted web content may lead to memory corruption
A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to an improper validation of the index to access an array, resulting in memory corruption...
CVE-2025-32369
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content for stored XSS via certain interactions with the media library file upload feature...
Kentico Xperience 安全漏洞
Kentico Xperience is a digital experience platform from Kentico, Inc. A security vulnerability exists in Kentico Xperience versions prior to 13.0.181 that originates from an authenticated user who could distribute malicious content...
Apache Tomcat Path Equivalence Vulnerability
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request...
Security update for python-Jinja2
This update for python-Jinja2 fixes the following issues: CVE-2025-27516: Fixed Jinja sandbox breakout through attr filter selecting format method bsc1238879 CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template bsc1234808 CVE-2024-56326: Fixed sandbox breako...
SUSE-SU-2025:20254-1 Security update for python-Jinja2
This update for python-Jinja2 fixes the following issues: - CVE-2025-27516: Fixed Jinja sandbox breakout through attr filter selecting format method bsc1238879 - CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template bsc1234808 - CVE-2024-56326: Fixed sandbox...
CVE-2024-9311
A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...
CVE-2024-9920
In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/openfile' API...
K000150484: Apache Tomcat vulnerability CVE-2025-24813
Security Advisory Description Path Equivalence: 'file . Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through...
CVE-2024-9311
A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...
CVE-2024-9311
The vulnerability CVE-2024-9311 affects haotian-liu/llava v1.2.0 (LLaVA-1.6). A CSRF flaw lets an attacker upload files with malicious content without authentication, storing them in a predictable path and enabling arbitrary JavaScript execution in the victim’s browser when visiting the crafted f...
CVE-2024-9311 Cross-Site Request Forgery to XSS in haotian-liu/llava
A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...
PT-2025-12354 · Luxion · Luxion Keyshot
Name of the Vulnerable Software and Affected Versions: Luxion KeyShot versions 2024 13.0.0 Build 92 and 4.10.171 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required, as the target must visit a...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...