567 matches found
BIT-DOLIBARR-2023-4197 Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
Improper input validation in Dolibarr ERP CRM = v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code...
BELL-CVE-2025-21989
Bulletin has no description...
GHSA-G65G-FMCP-4W68 Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted
Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this...
GHSA-5R66-VGC7-2MM3 Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...
MAL-2025-2702 Malicious code in requests-promises (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f69e675db1c52596e208921e91e76489607213dc7f4f3c5ce9f9a824b02778e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Out-of-bounds Read
JSON is vulnerable to an out-of-bounds read. The vulnerability is due to improper handling of specially crafted JSON documents, allowing an attacker to cause a crash or leak sensitive memory contents...
GHSA-2HMP-5WQG-F24H PlotAI eval vulnerability
A vulnerability, that could result in Remote Code Execution RCE, has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. PlotAI commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting t...
Linux Distros Unpatched Vulnerability : CVE-2013-0339
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or...
CVE-2024-58020
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mtinputconfigured devmkasprintf can return a NULL pointer on failure,but this returned value in mtinputconfigured is not checked. Add NULL check in mtinputconfigured, to handle kernel NULL point...
CVE-2022-49105
In the Linux kernel, the following vulnerability has been resolved: staging: wfx: fix an error handling in wfxinitcommon One error handler of wfxinitcommon return without calling ieee80211freehwhw, which may result in memory leak. And I add one err label to unify the error handler, which is usefu...
CVE-2022-49647
In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...
CVE-2022-49398
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace listforeachentrysafe if using giveback The listforeachentrysafe macro saves the current item n and the item after n+1, so that n can be safely removed without corrupting the list. However, when traversi...
MAL-2025-1452 Malicious code in yizhifabao58 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ced901d0e5c904cb9495a0a9f7f06831e23fb03344b950107899ac7e8f8f00f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-1058
CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded...
CVE-2025-21376
Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...
User Enumeration
pimcore/admin-ui-classic-bundle is vulnerable to User Enumeration. The vulnerability is due to improper error handling in the "Forgot password" function, which reveals valid account usernames, allows an attacker to identify existing user accounts and use them for further attacks such as brute-for...
CVE-2022-21420
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence...
CVE-2024-43121
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1...
CVE-2025-24967 Stored XSS on Admin Panel When Deleting a User in reNgine
reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting XSS vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This...