5067 matches found
AZL-65978 CVE-2025-8177 affecting package libtiff for versions less than 4.6.0-8
A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It...
UBUNTU-CVE-2025-8177
A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It...
CVE-2025-8176 LibTIFF tiffmedian.c get_histogram use after free
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function gethistogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the publi...
CVE-2025-8176 LibTIFF tiffmedian.c get_histogram use after free
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function gethistogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the publi...
CVE-2025-8176
CVE-2025-8176 affects LibTIFF up to 4.7.0, with a use-after-free in the get_histogram implementation (tools/tiffmedian.c). Exploitation is local, and public exploits have been disclosed. A patch is available: fe10872e53efba9cc36c66ac4ab3b41a839d5172; apply the official patch/update to mitigate. R...
GHSA-P9QM-P942-Q3W5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWikisearchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query for example in the...
WordPress Timber plugin <= 1.23.1 - Use of a Vulnerable Dependency vulnerability
Use of a Vulnerable Dependency vulnerability discovered by WordFence in WordPress Plugin Timber versions = 1.23.1...
WordPress KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Theme <= 4.21.0 is vulnerable to Local File Inclusion
Software KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Type Theme Vulnerable versions = 4.21.0 Fixed in 4.22.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-6991 Patch priority Low CVSS severity Low 7.5 Developer EPC PSID 34bd1e68ee25 Credits stealthcopt...
GHSA-VR59-GM53-V7CQ XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Impact It's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. One can see the result of the injection with...
CVE-2025-53832
Lara Translate MCP Server is a Model Context Protocol MCP Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...
Security Bulletin: Netty SslHandler Vulnerability Leads to Native Crash via Crafted Packet
Summary Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which...
CVE-2025-54072
The CVE-2025-54072 entry concerns yt-dlp prior to version 2025.07.21 on Windows, where using --exec with the default placeholder or {} led to insufficient sanitization of the expanded filepath and could cause remote code execution. This effectively bypasses the mitigation from CVE-2024-22423. Aff...
CVE-2025-7865
A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross...
CVE-2025-7953 Sanluan PublicCMS viewer.html redirect
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open...
CVE-2025-7953 Sanluan PublicCMS viewer.html redirect
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open...
SAP Netweaver Visual Composer Insecure Deserialization (3604119)
SAP NetWeaver Visual Composer is affected by an insecure deserialization vulnerability caused by insufficient validation of uploaded content, when deserialized, provided by a high-privileged user. This allows an attacker to potentially compromise the confidentiality, integrity, and availability o...
CVE-2025-7863
A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be...
CVE-2025-7763
A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...
CVE-2025-7797
GPAC up to 2.4 contains a vulnerable function gf_dash_download_init_segment in src/media_tools/dash_client.c where manipulation of base_init_url can cause a null pointer dereference. The vulnerability can be triggered remotely and the exploit has been disclosed publicly. A patch is available (153...
