11817 matches found
CVE-2023-51325
PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting XSS in the "title, name" parameters...
CVE-2023-51323
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...
PT-2025-7306 · Phpjabbers · Phpjabbers Shared Asset Booking System
Name of the Vulnerable Software and Affected Versions: PHPJabbers Shared Asset Booking System version 1.0 Description: The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation in the...
CVE-2023-51323
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...
CVE-2023-51325
PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting XSS in the "title, name" parameters...
PT-2025-7562 · Tenda · Tenda Ac8V4
Name of the Vulnerable Software and Affected Versions: Tenda AC8V4 version V16.03.34.06 Description: A vulnerability was found in the function SUB 0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk crypto leads to a stack-based buffer overflow. Recommendations: For...
Malicious code in @supera/shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49646b06c192dbf0af2ad637e18b135b9b07b4d33bf270720fb46c6037d47f62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
D-Link DIR-853 PSK Parameter Buffer Overflow Vulnerability
The D-Link DIR-853 is a dual-band wireless router that supports the 802.11ac protocol and provides dual-band 2.4GHz up to 400Mbps and 5GHz up to 867Mbps network connectivity for HD video streaming and online gaming. The D-Link DIR-853 suffers from a buffer overflow vulnerability that originates...
CVE-2025-26158
creationtimestamp| type| source ---|---|--- 2025-02-14 16:45:01+00:00| seen| https://infosec.exchange/users/cve/statuses/114003247198101013 2025-02-14 17:16:20+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li5penlxzf2e 2025-02-14 18:45:02+00:00| seen|...
OESA-2025-1134 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication...
SUSE CVE-2023-49582
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h Users are...
Exposure of Data Element to Wrong Session
Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the shared instance used in field injection without a CDI scope. An attacker can manipulate request data, impersonate users, or access sensitive information by exploiting the leakage of...
PT-2025-23640
Name of the Vulnerable Software and Affected Versions Jupyter Core versions prior to 5.8.0 Description The issue affects Jupyter Core on Windows, where the shared %PROGRAMDATA% directory is searched for configuration files, potentially allowing users to create files that impact other users. This ...
CVE-2025-24973
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...
CVE-2025-24973
CVE-2025-24973 (Concorde/Nexkey) affects Concorde versions prior to 12.25Q1.1. The root cause is an improper logout implementation where authentication credentials remain in cookies after logout, potentially allowing an attacker to steal tokens. Impact is severe if a user with admin privileges is...
CVE-2025-24973 Concorde not removing authentication tokens after logging out
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...
CVE-2025-24973 Concorde not removing authentication tokens after logging out
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...
CVE-2025-24973 Concorde not removing authentication tokens after logging out
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Added a check for the srqmaxsge attribute. The maxsge attribute is provided by the user and is inserted and used unchecked. Therefore, ensure that the value does not exceed the maximum allowed value before using it...
Astra Linux – Vulnerability in APR
The lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users to read access to named shared memory segments, potentially exposing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h. Users...