5732 matches found
ROS-20250905-08
A vulnerability in the package manager for Kubernetes Helm is related to the creation of a JSON schema file in such a way, that Helm could use all available memory. Exploitation of the vulnerability could allow an attacker, acting remotely, to cause a denial of service A batch manager vulnerabili...
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
...
SQL Injection
Overview cornflow is a cornflow is an open source multi-solver optimization server with a REST API built using flask. Affected versions of this package are vulnerable to SQL Injection via the validatepayload method in validators.py file, which fails to enforce strict schema checks. Remediation...
Denial Of Service (DoS)
helm.sh/helm/v3 is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of crafted JSON Schema files with $ref pointing to /dev/zero, which allows an attacker to exhaust system memory leading to OOM termination...
Linux Distros Unpatched Vulnerability : CVE-2016-8290
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance...
Linux Distros Unpatched Vulnerability : CVE-2025-32387
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parse...
GraphQL Armor Max-Depth Plugin Bypass via fragment caching
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
PT-2025-36624
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
CVE-2025-52085
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...
MAL-2025-41329 Malicious code in schema-author (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d20adbaf902fa0024093fa6d9d1b21fe5c6f50e1fd5f11e13549e4cfe38e6de4 The OpenSSF Package Analysis project identified 'schema-author' @...
Malicious code in schema-author (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d20adbaf902fa0024093fa6d9d1b21fe5c6f50e1fd5f11e13549e4cfe38e6de4 The OpenSSF Package Analysis project identified 'schema-author' @...
Malicious code in action-schema-compiler (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41360 Malicious code in action-schema-compiler (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-52085
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...
PT-2025-34475 · Yoosee · Yoosee
Name of the Vulnerable Software and Affected Versions: Yoosee version 6.32.4 Description: An SQL injection flaw exists in the Yoosee application that allows authenticated users to inject arbitrary SQL queries through a request to a backend API endpoint. Successful exploitation can lead to the...
CVE-2025-52085
The Yoosee smart home mobile application, version v6.32.4 , contains an SQL injection vulnerability (CWE-89). This flaw allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint . Successful exploitation enables the extraction of sensitive database informa...
Linux Distros Unpatched Vulnerability : CVE-2020-2694
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.18 and prior...
Apache Superset Information Disclosure Vulnerability (CNVD-2025-19102)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that stems from the /chart/data endpoint response containing underlying query information, which can be exploited by an attack...
Linux Distros Unpatched Vulnerability : CVE-2017-10283
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Performance Schema. Supported versions that are affected are 5.6.37 and earlie...