Linux Distros Unpatched Vulnerability : CVE-2024-57258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdifft ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET subscription endpoint. An attacker can access sensitive subscription details by sending unauthorized API requests. Remediation Upgrade github.com/mattermost/mattermost-plugin-confluence/server/serialize...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET subscription endpoint. An attacker can access sensitive subscription details by sending unauthorized API requests. Remediation Upgrade github.com/mattermost/mattermost-plugin-confluence/server to versio...

LibreChat 授权问题漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An authorization issue vulnerability exists in LibreChat versions 0.0.6 through 0.7.7-rc1, which stems from a test endpoint exposure that could lead to the disclosure of arbitrary user chat logs...

XWiki Platform 输入验证错误漏洞

XWiki Platform is the XWiki open source suite of Wiki platforms for creating web collaboration applications. An input validation error vulnerability exists in XWiki Platform versions 17.0.0-rc1 through 17.2.2 and 16.10.5 and earlier, which stems from an uncleaned SQL query and could lead to a SQL...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik Open Source. A security vulnerability exists in authentik versions 2025.4.4 and earlier and 2025.6.0-rc1 through 2025.6.3, which stems from insufficient validation of OAuth/SAML account status, and may result in some...

Zulip server 跨站脚本漏洞

Zulip server is an open source team chat application from Zulip Inc. in the United States. A cross-site scripting vulnerability exists in Zulip server versions 2.0.0-rc1 through prior to 10.4, which stems from a cross-site scripting vulnerability in the /digest/ URL...

Stack-based Buffer Overflow

Overview com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation Affected versions of this package are vulnerable to Stack-based Buffer Overflow due to the parse process, which accepts an unlimited input file with deeply nested data. An...

Argo CD 跨站脚本漏洞

Argo CD is an Argo open source declarative GitOps continuous delivery tool for Kubernetes. A cross-site scripting vulnerability exists in Argo CD 1.2.0-rc1 and earlier versions, which stems from insufficient URL protocol filtering and could lead to cross-site scripting attacks...

CVE-2024-24013

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list...

CVE-2024-24021

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list...

CVE-2023-46256

PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of parserbufindex value checking. A malfunction of the sensor device can cause a heap buffer overflow...

CVE-2020-26138

In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation...

CVE-2019-14804

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...

CVE-2019-14805

studio/buildermenu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

PT-2025-18514 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.0-rc1 Description: A potential null pointer dereference issue has been identified in the Linux kernel, specifically in the kprobe event gen test exit function. This issue occurs when the trace get event file...

DEBIAN-CVE-2025-29906

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the tty configuration directive that can bypass /bin/login, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.1...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata when executing the UpdateChannelBookmark function, due to improper handling of user permissions. By creating a bookmark referencing a deleted file, an attacker can expose metadata from...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in command.go that allows a user to execute commands on archived channels. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.9-rc1, 10.3.4, 10.4.3 or higher. References -...