13080 matches found
CVE-2025-25928
A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...
CVE-2025-25925
A stored cross-scripting XSS vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form...
CVE-2025-2136
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...
CVE-2024-53307
A reflected cross-site scripting XSS vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...
BELL-CVE-2024-11235
Bulletin has no description...
MAL-2025-2347 Malicious code in cryptomus-aurora-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db5768718bc2c708ec27865d8e381f97ca5fb81b191a946bc786bb0350aaec26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-28938
Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through = 2.5.3...
CVE-2025-28943
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through = 1.0.2...
CVE-2025-28878
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through = 2.0.10...
CVE-2025-28940
Cross-Site Request Forgery CSRF vulnerability in arkapravamajumder Back To Top backtotop allows Cross Site Request Forgery.This issue affects Back To Top: from n/a through = 2.0...
CVE-2025-21853
In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freezemutex during mmap operation We use map-freezemutex to prevent races between mapfreeze and memory mapping BPF map contents with writable permissions. The way we naively do this means we'll hold freezemutex...
CVE-2024-58088
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a "bpf: Prevent deadlock from recursive bpftaskstorageget|delete" first introduced deadlock prevention for fentry/fexit programs attaching on...
CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
MAL-2025-2374 Malicious code in digits-electron-src (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cbfd2aa51f6d4ff7a9bc75c482e5fde9d3f100b1f911d8f55dbc642696897aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2390 Malicious code in needlecast_prodeng_bfg_ui_consumerclient (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 272f9b4996fbc4cfee6747503b6a638f698e0abc73f58320de726520712174ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-24082
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2025-24974 DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available...
GO-2025-3508 LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper
LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper...
CVE-2024-7296 Incorrect Authorization in GitLab
An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users...