13120 matches found
MAL-2025-2743 Malicious code in @takamol/qiwa-library (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8afeca0176de89770761716c5f7c943d66f533995c20d1e3a4ed81f2a51f8f54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-28094
shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places...
CVE-2025-28096
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery SSRF in custom headers...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
CVE-2024-56975
InvoicePlane all versions tested as of December 2024 v.1.6.11 and before contains a remote code execution vulnerability in the uploadfile method of the Upload controller...
GHSA-WQ32-8RP4-W2MC Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow
An integer overflow in Nethermind Juno before v0.12.5 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop and high CPU usage by submitting a malicious Declare v2/v3 transaction. This results in a...
CVE-2023-53016 Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcommskstatechange syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease could have the...
CVE-2022-49745 fpga: m10bmc-sec: Fix probe rollback
In the Linux kernel, the following vulnerability has been resolved: fpga: m10bmc-sec: Fix probe rollback Handle probe error rollbacks properly to avoid leaks...
CVE-2023-52941 can: isotp: split tx timer into transmission and timeout
In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frame...
CVE-2025-22628
CVE-2025-22628 describes a CSRF-to-Stored XSS risk in the WordPress plugin Filled In . Affected versions are listed as
CVE-2025-30221 Pitchfork HTTP Request/Response Splitting vulnerability
Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available...
MAL-2025-2732 Malicious code in @johndeere-tech/helios-mat-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 226a36baff3a45f171643849384a2b5ba6f9120f2a98d58b2589fc9381fc1c8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-2867 Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized...
CVE-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...
RUSTSEC-2025-0032 Safe API can cause heap-buffer-overflow
ffi::nstr should be marked unsafe, since a pointer to a buffer without a trailing 0 value will cause a heap buffer overflow...
CVE-2024-55073
A Broken Object Level Authorization vulnerability in the component /api/users/user-id of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household...
OPENSUSE-SU-2025:14933-1 corosync-3.1.9-2.1 on GA media
These are all security issues fixed in the corosync-3.1.9-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2025-30093
HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions...