ROS-20251002-02

A vulnerability in the Netty networking software is associated with incorrect validation of HTTP/1.1 requests. Exploitation of the vulnerability could allow an attacker acting remotely to perform spoofing attacks against HTTP requests. HTTP requests A vulnerability in the Netty networking softwar...

CVE-2025-47910 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...

Student Result Management System Using PHP Cross-Site Request Forgery Vulnerability

Student Result Management System Using PHP is a student result management system. A cross-site request forgery vulnerability exists in Student Result Management System Using PHP, which stems from a Profile Page that does not adequately validate that a request is coming from a trusted user, no...

DragonFly's manager generates mTLS certificates for arbitrary IP addresses

A peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the pee...

CVE-2025-20270 Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of reques...

PT-2025-35806

Name of the Vulnerable Software and Affected Versions Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure affected versions not specified Description A vulnerability exists in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisc...

The vulnerability of the Appliance Work Place microprogramming software for SonicWall SMA 1000 series network interface devices allows a perpetrator to execute an SRF attack.

The vulnerability of the Appliance Work Place microprogramming software for SonicWall’s SMA 1000 series network interface controllers is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow a remote attacker to execute an SRF attack...

CVE-2025-40703 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH

Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...

OpenAtlas 跨站脚本漏洞

OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...

The vulnerability of the PreventLocalEntityResolver class in the software for administrative and publishing of geodata on the OSGeo GeoServer server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PreventLocalEntityResolver class in the software for administrative and publishing of geodata on the OSGeo GeoServer server is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker, operating remotely, to...

The vulnerability of the software server for processing SIP traffic in drachtio-server, related to the inability to properly validate requests, allows attackers to trigger a service failure.

The vulnerability of the drachtio-server software for processing SIP traffic is related to an unaddressed flaw. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2025-38264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's not part of any list, otherwise a malicious R2T PDU might injec...

PT-2025-43979

Уязвимость PHP-библиотеки TCPDF связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить SSRF-атаку...

DEBIAN-CVE-2025-38494

In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hidhwrawrequest hidhwrawrequest is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid...

UBUNTU-CVE-2025-38430

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure...

The vulnerability of the Apache HTTP Server web server, related to insufficient validation of incoming requests, allows attackers to perform SSRF attacks.

The vulnerability of the Apache HTTP Server is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

The vulnerability of the Import Avatar function in the MyBB forum creation software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the “Import Avatar” function in the MyBB forum creation software is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the XML2PDF library, related to insufficient validation of requests on the server side, allows a attacker to perform an SSRF attack.

The vulnerability of the XML2PDF library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP request...

The vulnerability of the ColdFusion software platform, related to insufficient validation of incoming requests, allows attackers to trigger service failures.

The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

SUSE CVE-2025-38264

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing...