2239 matches found
CVE-2025-55000
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...
OESA-2025-1981 python-Flask-Cors security update
A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching...
The vulnerability of the path.normalize() function in the Node.js software platform allows attackers to compromise the confidentiality and integrity of protected information.
The vulnerability of the path.normalize function in the Node.js platform is related to incorrect restrictions on the path name of a directory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...
SAEL: Leveraging Large Language Models with Adaptive Mixture-Of-Experts for Smart Contract Vulnerability Detection
With the increasing security issues in blockchain, smart contract vulnerability detection has become a research focus. Existing vulnerability detection methods have their limitations: 1 Static analysis methods struggle with complex scenarios. 2 Methods based on specialized pre-trained models...
Exploit for CVE-2025-52488
DNN Unicode Path Normalization NTLM Hash Disclosure Exploit C...
DNN Unicode Path Normalization NTLM Hash Disclosure
This exploit targets a vulnerability in DNN formerly DotNetNuke versions 6.0.0 to before 10.0.1 that allows attackers to disclose NTLM hashes through Unicode path normalization attacks...
Efficient Private Inference Based on Helper-Assisted Malicious Security Dishonest Majority MPC
Private inference based on Secure Multi-Party Computation MPC addresses data privacy risks in Machine Learning as a Service MLaaS. However, existing MPC-based private inference frameworks focuses on semi-honest or honest majority models, whose threat models are overly idealistic, while malicious...
Astra Linux – Vulnerability in Raptor2
In the Raptor RDF Syntax Library version 2.0.16, there is an integer underflow issue when normalizing a URI using the turtle parser in the raptorurinormalizepath function...
OSV-2025-466 Security exception in java.base/java.lang.AbstractStringBuilder.<init>
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424617284 Crash type: Security exception Crash state: java.base/java.lang.AbstractStringBuilder. java.base/java.lang.StringBuilder. com.ctc.wstx.util.StringUtil.normalizeSpaces...
PT-2025-37422
Name of the Vulnerable Software and Affected Versions Hugging Face Transformers versions up to 4.52.4 Description A Regular Expression Denial of Service ReDoS vulnerability exists in the normalize numbers method of the EnglishNormalizer class. This issue arises from the method's handling of numer...
Debian dla-4197 : python3-flask-cors - security update
The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4197 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4197-1 [email protected]...
CVE-2024-45412
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...
CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User...
CVE-2023-41889
SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface...
CVE-2023-42183
lockss-daemon aka Classic LOCKSS Daemon before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick...
CVE-2021-31155
Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command...
CVE-2021-29548
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in tf.rawops.QuantizedBatchNormWithGlobalNormalization. This is because the...
OESA-2025-1453 raptor2 security update
Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fixes: In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in...
