CVE-2025-47269

Summary: The code-server CVE-2025-47269 vulnerability affects versions before 4.99.4, where a maliciously crafted URL using the built-in proxy /proxy subpath can cause the proxy to forward to an attacker-controlled domain, potentially exposing a user’s session token and enabling session hijacking...

CVE-2024-6829

CVE-2024-6829 affects aimhubio/aim 3.19.3. The vulnerability arises in tarfile.extractall(), allowing an attacker-controlled tarfile to be extracted to arbitrary locations on the host by manipulating repo.path and run_hash. This bypasses directory existence checks and can result in arbitrary file...

CVE-2019-2483

The CVE-2019-2483 issue affects Oracle iStore Shopping Cart in Oracle E-Business Suite. Affected versions are 12.1.1–12.1.3 and 12.2.3–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise iStore, requiring user interaction, and can lead to unauth...

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2023-41034 DDFFileParser in eclipse leshan is vulnerable to XXE Attacks

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...

Updated tigervnc/x11-server packages fix security vulnerability

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window aka COW, the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-fr...

CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability

...

Bullwark Momentum Series JAWS 1.0 - Directory Traversal

Bullwark Momentum Series JAWS 1.0 - Directory Traversal Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal Date: 2019-12-11 Author: Numan Türle Vendor Homepage: http://www.bullwark.net/ Version : Bullwark Momentum Series Web Server JAWS/1.0 Software Link :...

CVE-2013-4584

Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssloutgoingciphers not being applied to STARTTLS connections...

EUVD-2018-2725

There is an XML External Entity XXE Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3...

CVE-2006-2716

CVE-2006-2716 affects the Secure Elements Class 5 AVR server (aka C5 EVM) prior to version 2.8.1. The vulnerability stems from a hard-coded user ID and password, which enables remote attackers to gain access to the server. The connected sources confirm the affected component and root cause as har...

Apache mod_ssl 2.8.7 OpenSSL - OpenFuckV2.c Remote Buffer Overflow (1)

Apache modssl 2.8.7 OpenSSL - OpenFuckV2.c Remote Buffer Overflow 1 / E-DB Note: Updated exploit https://www.exploit-db.com/exploits/47080 E-DB Note: Updating OpenFuck Exploit http://paulsec.github.io/blog/2014/04/14/updating-openfuck-exploit/ OF version r00t VERY PRIV8 spabam Compile with: gcc -...

Summit Computer Networks Lil HTTP Server 2 - URLCount.cgi HTML Injection

Summit Computer Networks Lil HTTP Server 2 - URLCount.cgi HTML Injection source: https://www.securityfocus.com/bid/5115/info Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks. Reportedly, Lil' HTTP Server is vulnerable to HTML...

CVE-1999-0734

A default configuration of CiscoSecure Access Control Server ACS allows remote users to modify the server database without authentication...

Security Update for Microsoft Groove Server 2010 (KB2346298)

A security vulnerability exists in Microsoft Groove Server 2010 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office Online Server (KB5002276) farm-deployment

A security vulnerability exists in Microsoft Office Online Server that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office Web Apps Server 2013 (KB5002261)

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office SharePoint Server 2007 (KB2596663) 32-Bit Edition

A security vulnerability exists in Microsoft Office SharePoint Server 2007 32-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...