487 matches found
OSV-2025-989 Bad-cast to UT_hash_bucket' (aka 'struct UT_hash_bucket')password_file__cleanup
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=468922225 Crash type: Bad-cast Crash state: Bad-cast to UThashbucket' aka 'struct UThashbucket'passwordfilecleanup mosquittosecuritycleanupdefault brokerfuzzpasswordfile.cpp...
CVE-2024-58302
FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email...
CVE-2024-58310 APC Network Management Card 4 Path Traversal via Directory Traversal
APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like /etc/passwd by using encoded path...
CVE-2024-58302 FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings
FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email...
CVE-2021-47724 STVS ProVision Authenticated File Disclosure via archive.rb
STVS ProVision 5.9.10 contains a path traversal vulnerability that allows authenticated attackers to access arbitrary files by manipulating the files parameter in the archive download functionality. Attackers can send GET requests to /archive/download with directory traversal sequences to read...
EUVD-2025-200300
A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...
Arbitrary Code Injection
Overview pywikibot is a Python MediaWiki Bot Framework Affected versions of this package are vulnerable to Arbitrary Code Injection via the readPassword method in pywikibot.login, which used eval on password file entries. Each non-empty, non-comment line from the configured password file was...
Red Hat OpenShift Dev Spaces 安全漏洞
Red Hat OpenShift Dev Spaces is a cloud-based development environment from Red Hat USA. A security vulnerability exists in Red Hat OpenShift Dev Spaces that stems from improper permissions in the /etc/passwd file, which could result in elevated privileges within the container...
CVE-2025-13565 SourceCodester Inventory Management System resetPassword.php password recovery
A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made...
OSV-2025-932 Heap-use-after-free in password_file__cleanup
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462551340 Crash type: Heap-use-after-free READ 8 Crash state: passwordfilecleanup mosquittosecuritycleanupdefault brokerfuzzpasswordfile.cpp...
EUVD-2024-55095
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php...
EUVD-2024-55083
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php...
PHPGurukul Student Record System 安全漏洞
Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that stems from a lack of validation of the currentpassword parameter in change-password.php against an externally entered SQL statement. An attacker can exploit this vulnerability to...
PT-2025-44041
A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public...
CVE-2025-58712
A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root...
XML External Entity (XXE)
langchaincommunity is vulnerable to XML External Entity XXE. The vulnerability is due to insecure XML parsing in the EverNoteLoader component that uses etree.iterparse without disabling external entity references, which allows an attacker to craft a malicious XML payload to access sensitive local...
EUVD-2000-0568
Malware in sbrugna...
EUVD-2001-1392
Malware in sbrugna...