CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

Mongoose 代码注入漏洞

Mongoose is an Automattic open source modeling of MongoDB objects designed to work in an asynchronous environment. A code injection vulnerability exists in Mongoose versions prior to 8.9.5 that stems from incorrect use of nested filters and populate matches, resulting in search injection...

PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...

drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails

...

UBUNTU-CVE-2024-46769

In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devmkasprintf returned value intelspipopulatechip use devmkasprintf to set pdata-name. This can return a NULL pointer on failure but this returned value is not checked...

PT-2024-31346

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the dpu format populate layout function in the Linux kernel, which fails to clean up the FB when it fails, causing a leak of the pin count on the GEM...

SUSE CVE-2024-37676

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the HeaderpopulateFromSettings function...

AZL-42826 CVE-2024-37676 affecting package htop 3.0.5-5

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the HeaderpopulateFromSettings function...

htop Security Vulnerabilities

htop is a cross-platform interactive process viewer from htop open source. A security vulnerability exists in htop version v.2.20, which stems from out-of-bounds access in the HeaderpopulateFromSettings function...

PT-2024-26508 · WordPress · Wordpress Backup & Migration

Name of the Vulnerable Software and Affected Versions: WordPress Backup & Migration plugin versions up to, and including, 1.4.8 Description: The issue allows authenticated attackers with subscriber access or above to access log files maintained by the plugin due to a missing capability check on t...

Improper Authorization

strapi-plugin-protected-populate is vulnerable to Improper Authorization. The vulnerability is due to the protectPopulate function of protect-route.js, which allows a users to populate fields they don't have access, resulting in field-level security bypass...

CVE-2023-48218

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

Authentication flaw

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

CVE-2023-48218

The Strapi Protected Populate Plugin protects "get" endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has...

CVE-2023-48218 Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

CVE-2023-48218

The CVE-2023-48218 issue affects the Strapi Protected Populate Plugin. Pre-1.3.4 versions allowed bypassing field-level security by populating fields the user should not access on get endpoints. It has been patched in version 1.3.4; no workarounds are documented. CVSSv3.1 base score 5.3 (NETWORK,...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi Protected Populate Plugin versions prior to 1.3.4. An attacker could exploit the vulnerability to populate certain fields...

PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Name of the Vulnerable Software and Affected Versions: Strapi Protected Populate Plugin versions prior to 1.3.4 Description: The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the...

CVE-2023-48218: Incorrect Authorization

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

PT-2025-8649

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been resolved, related to error handling in gic populate ppi partitions. The of get child by name function returns a node pointer with an incremented...