850 matches found
CVE-2022-0848
CVE-2022-0848 تنفيذ التعليمات البرمجية عن بُعد RCE في part-db 0.5.11 قم بتغيير المضيف في ملف bash وقم بتشغيله...
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...
CVE-2025-51867
CVE-2025-51867 وصف الثغرة ديبفيشن AI Deepfiction AI هي شركة ترفيه تعمل بالذكاء الاصطناعي مهمتها إحداث ثورة في رواية القصص المخصصة. توفر ديبفيشن AI تطبيق ويب لإنشاء القصص من خلال الدردشة مع نموذج اللغة الكبير LLM، وهو معرض لثغرة الإسناد المباشر غير الآمن Insecure Direct Object Reference IDOR في مك...
CVE-2026-78587
Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...
CVE-2026-78587
Fleet Server (Elastic) contains an Incorrect Authorization (CWE-863) flaw where session ownership is not correctly verified during multi-part data upload operations. This allows any authenticated agent to interfere with active upload sessions belonging to other enrolled agents, resulting in a den...
CVE-2022-0848-RCE
CVE-2022-0848 تنفيذ التعليمات البرمجية عن بعد RCE في part-db 0.5.11 قم بتغيير المضيف في ملف bash وقم بتشغيله، ثم احصل على شيل عبر RCE...
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability...
CVE-2025-48384-PoC-Part2
لا يحتوي هذا المستودع على ملف README...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053
Horde IMP (webmail application) contains a stored cross-site scripting vulnerability in its AppleDouble MIME viewer. In lib/Mime/Viewer/Appledouble.php, the _IMPrender() method passes the MIME part's name parameter through sprintf into an IMP_Mime_Status object without escaping; IMP_Mime_Status::...
Astra Linux – Vulnerability in Thunderbird
If a MIME-encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only certain parts of the message are protected. This vulnerability affects Thunderbird versions earlier than 78.10.2...
Astra Linux – Vulnerability in nss
A flaw was discovered in the implementation of CHACHA20-POLY1305 in NSS versions prior to 3.55. When using multi-part Chacha20, it could lead to out-of-bounds reads. This issue was addressed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and enforcing strict tag...
CVE-2026-16779
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
MINI-44PV-2M65-C8GX
Bulletin has no description...
EUVD-2026-35096
Req vulnerable to multipart form-data header injection via unescaped name/filename/contenttype...
CVE-2026-64414
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...
EUVD-2026-48958
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...
CVE-2026-64414 netfilter: handle unreadable frags
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...