CVE-2024-52888

For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties...

CVE-2024-52888

CVE-2024-52888 affects Check Point Mobile Access (R82 and earlier). An authenticated end-user may trigger a script during the portal’s display of a directory or file properties, consistent with a stored XSS issue in the File Share access path. The observable behavior is a script execution within ...

CVE-2024-52888 Stored-XSS

For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties...

GHSA-3G36-GF7C-75QW Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of servi...

WordPress Reales WP theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates vulnerability

Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates vulnerability discovered by Lucio Sá in WordPress Theme Reales WP versions = 2.1.2...

[SECURITY] Fedora 41 Update: rust-icu_properties-1.5.1-1.fc41

Definitions for Unicode properties...

[SECURITY] Fedora 40 Update: rust-icu_properties-1.5.1-1.fc40

Definitions for Unicode properties...

[SECURITY] Fedora 42 Update: rust-icu_properties-1.5.1-1.fc42

Definitions for Unicode properties...

[SECURITY] Fedora 42 Update: rust-icu_properties_data-1.5.1-1.fc42

Data for the icuproperties crate...

Prototype Pollution

estree-util-value-to-estree is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object properties due to generating ESTree expressions that interpret proto as a prototype rather than a normal property...

Prototype Pollution

expand-object is vulnerable to Prototype Pollution. The vulnerability is due to improper input validation in the expand function in index.js, which expands strings into objects without filtering out sensitive properties like proto, and allows attackers to manipulate object prototypes, potentially...

Insertion of Sensitive Information into Log File

Overview org.apache.activemq:artemis-server is a server package for the ActiveMQ-Artemis project. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when the ConfigurationImpl logger is being set to debug level. An attacker can access sensitive...

crud-query-parser SQL Injection vulnerability

Impact Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. Versions 0.0.1, 0.0.2 and 0.0.3 are affected b...

CVE-2025-30677

Apache Pulsar IO Kafka connectors (Source, Sink, and Kafka Connect Adaptor Sink) log sensitive configuration properties in plain text in application logs. Affected components: Pulsar IO’s Apache Kafka connectors across versions before 3.0.11, 3.3.6, and 4.0.4. Consequence: potential exposure of K...

CVE-2025-3416

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string...

UBUNTU-CVE-2025-3416

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string...

OpenSSL 资源管理错误漏洞

OpenSSL is an open source general-purpose cryptographic library capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols from the OpenSSL team. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

CVE-2025-3197

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...

rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`

When a Some... value was passed to the properties argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string due to CString::drop's behavior. The maintainers thank quitbug for reporting th...

GHSA-4FCV-W3QC-PPGG rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`

When a Some... value was passed to the properties argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string due to CString::drop's behavior. The maintainers thank quitbug for reporting th...