DEBIAN-CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

UBUNTU-CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

CVE-2025-40927

CGI::Simple for Perl is affected in versions before 1.282, with an HTTP response splitting flaw enabling header injection that can lead to reflected XSS, open redirects, or related issues. The Fedora advisories confirm the fix is to upgrade to CGI-Simple-1.282 (1.fc43 and 1.fc42 updates), address...

CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

MetaCPAN CGI::Simple 安全漏洞

MetaCPAN CGI::Simple is a module for Perl from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN CGI::Simple versions prior to 1.282, which stems from HTTP response splitting and could lead to reflective cross-site scripting or open redirects...

PT-2025-36373

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 version 1.08.01 Description: A buffer overflow issue exists in the httpd component of D-Link DIR-825. The get ping6 app stat function within the ping6 response.cg file is affected. Manipulation of the ping6 ipaddr argument can...

CVE-2025-57767

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header wi...

PT-2025-35087

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Online Shopping System Advanced version 1.0 Description: A reflected Cross-Site Scripting XSS vulnerability exists in the register.php file. Unsanitized user input in the f name parameter is reflected in the server response...

Linux Distros Unpatched Vulnerability : CVE-2023-40547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows...

Linux Distros Unpatched Vulnerability : CVE-2023-0508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all...

CVE-2025-0074

In processserviceattrrsp of sdpdiscovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22411

CVE-2025-22411 affects the Android Bluetooth SDP discovery path: use-after-free in process_service_attr_rsp (sdp_discovery.cc) due to a logic error, enabling remote code execution with no privileges and no user interaction. Exploitation is described as proximal/adjacent (Bluetooth range). Root ca...

CVE-2025-22411

In processserviceattrrsp of sdpdiscovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0074

The CVE-2025-0074 issue affects Google Android’s sdp_discovery.cc (process_service_attr_rsp) where a use-after-free leads to remote code execution with network access and no user interaction. This is categorized as a critical RCE in Android 15 per the 2025-03-01 bulletin, with patch levels 2025-0...

CVE-2025-0074

In processserviceattrrsp of sdpdiscovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0074

In processserviceattrrsp of sdpdiscovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

django: Django Path Injection Vulnerability

A flaw was found in Django. The request.path component of HTTP requests is not properly escaped when included in internal response logging, allowing remote attackers to manipulate log output through crafted URLs. This vulnerability allows an attacker to inject arbitrary content into Django's...

Linux Distros Unpatched Vulnerability : CVE-2020-7695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add...

Linux Distros Unpatched Vulnerability : CVE-2025-4979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to...

Linux Distros Unpatched Vulnerability : CVE-2016-2045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HT...