231584 matches found
CVE-2024-25979
CVE-2024-25979 affects Moodle where the vulnerability stems from improper handling of URL parameters in the forum search feature, allowing parameters beyond those intended to be accepted. The root cause is unsecured/insufficient validation of user-supplied URL query parameters, which can lead to ...
CVE-2024-25978
CVE-2024-25978 : Moodle is affected by a denial-of-service risk due to insufficient file size checks in the file picker’s unzip functionality. The available connected documents confirm the vulnerability and its impact but do not provide concrete technical details such as affected versions or exac...
Sql injection
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a strin...
CVE-2024-1597
CVE-2024-1597 affects the PostgreSQL JDBC Driver (libpgjava) used with pgjdbc. The vulnerability exists when PreferQueryMode=SIMPLE is enabled (not the default); an attacker can inject SQL to alter queries. Affected versions include before 42.7.2, and older 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42....
Default credentials
Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants...
Default credentials
Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password...
Code injection
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue...
CVE-2024-25710
CVE-2024-25710 describes a Loop with Unreachable Exit Condition (Infinite Loop) in Apache Commons Compress, affecting versions 1.3 through 1.25.0. The issue is identified as a vulnerability in the compression library, with impact details indicating high severity in some advisories and a 5.5–8.1 C...
CVE-2024-26308
CVE-2024-26308 affects Apache Commons Compress: Allocation of Resources Without Limits or Throttling. The IBM bulletin lists the vulnerability as present in Apache Commons Compress 1.21 through 1.25.x and fixes it in 1.26. Impact is resource exhaustion/denial of service with a base score of 5.5 (...
CVE-2022-4094
Technical details for CVE-2022-4094 are not publicly available in the provided documents; no affected products, impact, or remediation are described. Monitor for updates.
CVE-2024-26327
CVE-2024-26327 affects QEMU 7.1.0–8.2.1, where register_vfs in hw/pci/pcie_sriov.c mishandles a guest write of NumVFs greater than TotalVFs, resulting in a buffer overflow in VF implementations. This is documented across multiple sources (e.g., Astra Linux security bulletin) and related entries d...
CVE-2022-48625
Concerning CVE-2022-48625, the vulnerability affects Yealink Config Encrypt Tool versions prior to 1.2, which ships with a built‑in RSA key pair. This design enables potential decryption of encrypted deployment files by an adversary using the default key. The impact is a decryption risk (per the ...
CVE-2022-48624
CVE-2022-48624 affects the less utility (filename.c close_altfile) in versions prior to 606, where shell_quote handling for LESSCLOSE is omitted, enabling potential local command-injection via crafted filenames. Connected sources confirm the issue and show remediation guidance: upgrade to less 60...
CVE-2024-26318
Serenity CVE-2024-26318: In Serenity up to version 6.7.x, LoginPage.tsx allows return URLs not starting with a slash, which enables Cross‑Site Scripting via phishing/email links. The issue is described across multiple sources (Serenity release notes and Red Hat/Veracode advisories) as a client-si...
CVE-2020-36774
The CVE-2020-36774 issue affects GNOME Glade, specifically plugins/gtk+/glade-gtk-box.c. The vulnerability arises from how GladeGtkBox widget rebuilding is handled in Glade before 3.38.1 and in 3.39.x before 3.40.0, which can lead to a denial of service (application crash) due to incorrect widget...
Design/Logic Flaw
Signed to unsigned conversion esp32ipmsend...
Server side request forgery (ssrf)
can: out of bounds in removerxfilter function...
CVE-2023-5779
CVE-2023-5779 affects Zephyr RTOS can subsystem. The issue is an out-of-bounds write in the remove_rx_filter path, caused by insufficient bounds checks when filtering IDs. Specifically, multiple variants (e.g., can_stm32_remove_rx_filter, can_nxp_s32_remove_rx_filter, mcp2515_remove_rx_filter) ac...
CVE-2023-6249
CVE-2023-6249 affects the Zephyr RTOS component esp32_ipm_send. The root cause is a signed-to-unsigned conversion that can cause a buffer overflow in esp32_ipm_send (as described by Veracode), elevating risk for affected builds. Public documents describe a buffer overflow condition but do not spe...