Improper Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Authorization enabling bypass of a security feature. Remediation There is no fixed version for magento/project-community-edition. Reference...

Information Exposure

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Information Exposure which could allow a privileged attacker to escalate privileges. Remediation There is no fixed version for...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the /onlDragDatasetHead/getTotalData component. An attacker can manipulate the backend database and execute arbitrary SQL commands by injecting malicious SQL code into the input parameters. Note: This is a bypass f...

Improper Restriction of Excessive Authentication Attempts

Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Improper Restriction of Excessive Authentication Attempts due to improper rate limiting mechanism. An attacker can perform repeated login attempts without being restricted...

Access of Uninitialized Pointer

Overview Affected versions of this package are vulnerable to Access of Uninitialized Pointer in the AMF3CDAddProp function in amf.c which allows attackers to trigger an exploitable crash. Remediation There is no fixed version for rudloff/rtmpdump-bin. References - Talos Vulnerability Report -...

PT-2025-5741 · F5 · Big-Ip Configuration Utility

Name of the Vulnerable Software and Affected Versions: BIG-IP Configuration utility affected versions not specified Description: A stored cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility, allowing an attacker to run JavaScript in the context of the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the generateRow method. An attacker can execute arbitrary JavaScript code in the user's browser by crafting a malicious XML file that bypasses the XSS sanitizer when processed and rendered as HTML...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateNavigation function, which translates the XLSX file into an HTML representation and displays it in the response without proper sanitization for the sheet's title. Remediation There is no fixed...

Covert Timing Channel

Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Covert Timing Channel through the decryption process. An attacker can decrypt messages or forge signatures by exchanging a large number of messages with the vulnerable service Marvin...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization of the generateRowparameter in the \Writer\Html class. Remediation There is no fixed version for phpoffice/phpexcel. References - GitHub Commit Credit: Aleksey Solovev...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currency parameter of the Currency.php script. An attacker can execute arbitrary JavaScript code in the user's browser by crafting malicious input that is improperly sanitized. PoC html...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the constructor of the Downloader class. An attacker can execute arbitrary JavaScript code in the user's browser by manipulating GET parameters name and type. Workaround This vulnerability can be mitigat...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization passed through the quantity parameter. PoC html history.pushState'', '', '/'; document.forms0.submit; Remediation There is no fixed version for phpoffice/phpexcel. References -...

Cross-site Request Forgery (CSRF)

Overview pyspider is an A Powerful Spider System in Python Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the Flask endpoints. An attacker can manipulate the state of the application. Remediation There is no fixed version for pyspider. References -...

PT-2024-41015 · Hewlett Packard · Hplip

Name of the Vulnerable Software and Affected Versions: hplip affected versions not specified Description: The issue is related to the hpmud component of hplip, where the printer serial number is not properly sanitized. Recommendations: At the moment, there is no information about a newer version...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the improper handling of specific input types. An attacker can cause the application to crash by sending specially crafted input. Details Denial of Service DoS describes a family of attacks, all aimed at...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to an invalid memory read operation. Remediation There is no fixed version for pywasm3. References - GitHub Gist - GitHub Issue Credit: Ziyi Guo...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to improper handling in the Readutf8 function. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to improper handling in the Readutf8 function. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...

Arbitrary Code Injection

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Arbitrary Code Injection through any components that provided the code functionality running on the local machine rather than a sandboxed environment. An attacker can execu...