Glob 操作系统命令注入漏洞

Glob is a file matching software by isaacs individual developers. An operating system command injection vulnerability exists in Glob versions 10.3.7 through 11.0.3, which stems from command injection and could lead to arbitrary code execution...

curl: Double-free vulnerability in libcurl with rustls via NoServerCertVerifier condition leads to application crash

Summary: There is a double-free in libcurl with rustls. The root cause is reported and it is fixed in https://github.com/curl/curl/pull/19425, while I did not try to evaluate the actual triggering at that time. No AI was used to find the issue or generate the report. Affected version It was...

The vulnerability of the smb3_insert_range() function in the fs/cifs/smb2ops.c module of the Linux operating system allows a hacker to compromise the integrity and accessibility of protected information.

The vulnerability of the smb3insertrange function in the fs/cifs/smb2ops.c module of the Linux operating system is related to the incorrect implementation of the sequence of actions performed. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of t...

CVE-2025-54346

A Reflected Cross Site Scripting XSS vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information...

EUVD-2025-197626

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema...

CVE-2025-54559

An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content...

3rd-party-cpu-abuser (>=1.0.0, <=1.4.0), @2lkit/devtools (0.0.1-0) +163 more potentially affected by CVE-2025-13097 via chrome-devtools-frontend (>=1.0.377119-1, <=1.0.746710)

chrome-devtools-frontend NPM version =1.0.377119-1, =1.0.0, =1.2.2-beta, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =1.3.0-1, =1.0.1, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-13097 Source advisory: SNYK:JS-CHROMEDEVTOOLSFRONTEND-14038289...

CVE-2025-54346

A Reflected Cross Site Scripting XSS vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information...

CVE-2025-54346

A Reflected Cross Site Scripting (XSS) vulnerability exists in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 . The flaw allows an attacker to inject malicious scripts through a specially crafted request, potentially leading to browser hijacking and the capture of ...

CVE-2025-54562

The Application Server of Desktop Alert PingAlert (versions 6.1.0.11 through 6.1.1.2 ) is vulnerable to a flaw that allows for the disclosure of technical information via stack traces . An attacker could exploit this vulnerability to compromise confidentiality . To remediate this issue, it is rec...

CVE-2025-54342

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is Exposure of Sensitive Information because of Incompatible Policies...

CVE-2025-54345

An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor...

CVE-2025-54560

Desktop Alert PingAlert (versions 6.1.0.11 through 6.1.1.2 ) contains a Server-side Request Forgery (SSRF) vulnerability in its Application Server component. The root cause is the server's failure to implement sufficient authentication mechanisms to verify the origin of requests. An attacker can ...

CVE-2025-54559

An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content...

CVE-2025-54345

An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor...

Desktop Alert PingAlert 安全漏洞

Desktop Alert PingAlert is a network status monitoring tool developed by Desktop Alert, Inc. and is mainly used to monitor the status of network devices in real time and send alerts. Desktop Alert PingAlert suffers from an Improper Access Control vulnerability that stems from improper access...

CVE-2025-54342

The Application Server of Desktop Alert PingAlert versions 6.1.0.11 through 6.1.1.2 is vulnerable to an information disclosure flaw. The root cause is identified as incompatible policies , which can be exploited by attackers to expose sensitive information . To remediate this vulnerability, it is...

directus (>=11.13.0, <=11.13.1) potentially affected by CVE-2025-64746 via @directus/api (>=32.0.0, <=32.0.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.1 Source cves: CVE-2025-64746 Source advisory: SNYK:JS-DIRECTUSAPI-13985179...

CVE-2025-64745

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

EUVD-2023-60055

The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. A remote attacker can send a malformed request that triggers improper input parsing or memory handling, resulting...