6459 matches found
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when using the --inc-recursive option. This is due to a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis which allows a server to write files outside of the...
BIT-NODE-2024-27980
Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...
UBUNTU-CVE-2024-12087
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...
CVE-2024-12322
The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to missing or incorrect nonce validation on the 'updateoption' function. This makes it possible for unauthenticated attackers to update the...
PT-2025-4339
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6 Description A vulnerability in the Linux kernel has been resolved, which avoids a NULL pointer dereference if no valid extent tree is present. The issue was reported by Syzbot, which triggered a crash with a...
CVE-2023-47179 WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability
Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through = 2.4.6...
CVE-2023-47179 WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability
Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through = 2.4.6...
PT-2025-11966 · Suricata +1 · Suricata +1
Name of the Vulnerable Software and Affected Versions: Suricata versions affected versions not specified Description: The issue is related to the af-packet defrag option, which can lead to truncated packets. This affects Suricata in Debian Linux. No information is provided about the estimated...
PT-2026-7637
Name of the Vulnerable Software and Affected Versions ajv versions through 8.17.1 Description ajv Another JSON Schema Validator is susceptible to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data through JSON Pointer syntax $data...
PT-2025-39311
Name of the Vulnerable Software and Affected Versions tar-fs versions prior to 3.1.1 tar-fs versions prior to 2.1.3 tar-fs version 1.16.5 Description tar-fs provides filesystem bindings for tar-stream. Affected versions are susceptible to a symlink validation bypass if the destination directory i...
PT-2026-2898
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to the octeontx2-pf driver. The issue involves a shift-out-of-bounds error triggered when users provide small or zero ring sizes through the...
SUSE CVE-2024-56566
In the Linux kernel, the following vulnerability has been resolved: mm/slub: Avoid list corruption when removing a slab from the full list Boot with slubdebug=UFPZ. If allocated object failed in allocconsistencychecks, all objects of the slab will be marked as used, and then the slab will be...
GHSA-HQMP-G7PH-X543 TunnelVision - decloaking VPNs using DHCP
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the...
TunnelVision - decloaking VPNs using DHCP
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the...
DEBIAN-CVE-2024-56566
In the Linux kernel, the following vulnerability has been resolved: mm/slub: Avoid list corruption when removing a slab from the full list Boot with slubdebug=UFPZ. If allocated object failed in allocconsistencychecks, all objects of the slab will be marked as used, and then the slab will be...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from skb not being released when the TX metadata option in the xsk module is invalid...
CVE-2024-10856
The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the id parameter in the “wpdevartbookingcalendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...
WordPress plugin Maintenance & Coming Soon Redirect Animation 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An access control error vulnerability exists i...
CVE-2024-49765
CVE-2024-49765 affects Discourse where sites enabling Discourse Connect alongside local login methods could allow an attacker to bypass Discourse Connect to create accounts and log in. The issue is described as a bypass of login paths rather than a remote exploit; affected component is the Discou...
