429 matches found
CVE-2025-40703 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...
The vulnerability of the PreventLocalEntityResolver class in the software for administrative and publishing of geodata on the OSGeo GeoServer server allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the PreventLocalEntityResolver class in the software for administrative and publishing of geodata on the OSGeo GeoServer server is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker, operating remotely, to...
OpenAtlas 跨站脚本漏洞
OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...
Linux Distros Unpatched Vulnerability : CVE-2025-38264
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's not part of any list, otherwise a malicious R2T PDU might injec...
DEBIAN-CVE-2025-38494
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hidhwrawrequest hidhwrawrequest is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid...
UBUNTU-CVE-2025-38430
In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure...
The vulnerability of the Apache HTTP Server web server, related to insufficient validation of incoming requests, allows attackers to perform SSRF attacks.
The vulnerability of the Apache HTTP Server is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
The vulnerability of the Import Avatar function in the MyBB forum creation software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the “Import Avatar” function in the MyBB forum creation software is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the XML2PDF library, related to insufficient validation of requests on the server side, allows a attacker to perform an SSRF attack.
The vulnerability of the XML2PDF library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP request...
The vulnerability of the ColdFusion software platform, related to insufficient validation of incoming requests, allows attackers to trigger service failures.
The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...
SUSE CVE-2025-38264
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing...
CVE-2025-38264
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing...
PT-2025-27600 · Unknown · Active! Mail 6
Name of the Vulnerable Software and Affected Versions: Active! mail 6 versions 6.60.06008562 and earlier Description: A cross-site request forgery issue exists, potentially allowing unintended emails to be sent when a user, who is logged in, accesses a specially crafted URL. Recommendations: For...
PT-2025-27177 · WordPress · Blend Media Wordpress Cta
Name of the Vulnerable Software and Affected Versions: Blend Media WordPress CTA versions 1.6.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Blend Media WordPress CTA, allowing unauthorized requests. Recommendations: For Blend Media WordPress CTA versions 1.6.9 and...
Security update for libsoup
This update for libsoup fixes the following issues: CVE-2025-2784: Fixed Heap buffer over-read in skipinsignificantspace when sniffing content bsc1240750 CVE-2025-32050:Fixed Integer overflow in appendparamquoted bsc1240752 CVE-2025-32051:Fixed Segmentation fault when parsing malformed data URI...
The vulnerability of cloud software for creating and using Nextcloud Server and Nextcloud Enterprise Server lies in insufficiently checking incoming requests, allowing attackers to execute SSRF attacks.
The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
IBM InfoSphere Information Server 安全漏洞
IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A security vulnerability exists in IBM InfoSphere Information Server versions 11.7.0.0 through...
WordPress plugin Esselink.nu Settings 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Esselink.nu Settings plugin, which stems from a WEB application that does not adequately validate that a reque...
The vulnerability of the opennextjs package from Cloudflare’s network traffic balancing service for web applications allows attackers to execute arbitrary code.
The vulnerability of the opennextjs package, a network traffic balancing service for Cloudflare’s web applications, relates to insufficient validation of incoming requests. Exploiting this vulnerability allows an attacker to execute arbitrary code by manipulating requests sent from the server’s...