parse-server 授权问题漏洞

parse-server is a Node.js/Express parse server open-sourced by Parse Platform. An authorization issue vulnerability exists in parse-server versions prior to 7.5.2 and prior to 8.0.2, which stems from mishandling of third-party authentication and could result in authentication credentials being...

CVE-2024-8898

creationtimestamp| type| source ---|---|--- 2025-03-20 17:18:52+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8243 2025-08-11 18:27:49+00:00| seen| MISP/3e4b778d-5810-4171-a915-f1d106684af4...

CVE-2025-30157

creationtimestamp| type| source ---|---|--- 2025-03-20 16:27:16+00:00| published-proof-of-concept| https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9 2025-03-21 15:19:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8347 2025-03-21 18:29:08+00:0...

CVE-2024-6839

A flaw was found inflask-cors. This vulnerability allows unauthorized cross-origin access to sensitive data or functionality via improper regex path matching, prioritizing longer patterns over more specific ones. This issue leads to less restrictive CORS policies being applied to sensitive...

GHSA-7RXF-GVFG-47G4 Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

Cross-site Request Forgery (CSRF)

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

PYSEC-2025-81

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

CVE-2024-8487

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

PYSEC-2025-81

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

Danswer 访问控制错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An Access Control Error vulnerability exists in Danswer v1.4.1, which stems from a misconfiguration of CORS and could lead to the disclosure of sensitive information...

AgentScope 跨站请求伪造漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. AgentScope suffers from a cross-site request forgery vulnerability that stems from the CORS header on the AgentScope Studio backend server being configured too loosely to allow...

Prefect 访问控制错误漏洞

Prefect is a workflow orchestration tool from Prefect Open Source that enables developers to build, observe and react to data pipelines. An access control error vulnerability exists in Prefect version 2.20.2 that stems from a CORS misconfiguration that allows unauthorized domains to access...

CVE-2025-29118

creationtimestamp| type| source ---|---|--- 2025-03-19 20:29:53+00:00| seen| https://t.me/cvedetector/20664 2025-03-21 14:19:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8346 2025-08-12 13:33:27+00:00| seen| MISP/02fb130c-7874-4693-9b66-81ed91a2e996 2025-08-21...

Multiple vulnerabilities in home gateway HGW-BL1500HM

Overview Home gateway HGW-BL1500HM provided by KDDI CORPORATION contains multiple vulnerabilities listed below. Stored cross-site scripting in the NickName registration screen CWE-79 - CVE-2025-27567 Stored cross-site scripting in the USB storage file-sharing function CWE-79 - CVE-2025-27574 Path...

CVE-2025-2473

creationtimestamp| type| source ---|---|--- 2025-03-18 02:30:20+00:00| published-proof-of-concept| Telegram/xPyLJ8hNJRDUxn8t8rZbAyf5dlbYBXWoNoziKlH64CiXZ4 2025-03-18 03:31:09+00:00| seen| https://t.me/cvedetector/20555 2025-08-12 13:33:28+00:00| seen| MISP/02fb130c-7874-4693-9b66-81ed91a2e996...

CVE-2025-2472

creationtimestamp| type| source ---|---|--- 2025-03-17 23:48:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7888 2025-03-18 03:31:08+00:00| seen| https://t.me/cvedetector/20554 2025-08-12 13:33:28+00:00| seen| MISP/02fb130c-7874-4693-9b66-81ed91a2e996 2025-08-21...

CVE-2024-40635

creationtimestamp| type| source ---|---|--- 2025-03-17 21:47:32+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7865 2025-05-01 13:00:06+00:00| published-proof-of-concept| Telegram/Z0ari8MHZAzBUd7K9yxhwtBySsURYEVG61pidF9swyP9zTE 2025-05-04 22:18:50+00:00|...

CVE-2025-29779

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the secureredundantexecution function in feldmanvss.py attempts to mitigate fault injection attacks by executing a function...

CVE-2025-29780

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the...

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Description: The feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the findsecurepivot function and potentially other parts of securematrixsolve. These vulnerabilities are due to Python's execution model, which does not guarantee...