13090 matches found
CVE-2024-57426
NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the application loads dependencies. This vulnerability arises due to the improper validation of dynamically loaded libraries...
CVE-2024-57086
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-49796
IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim...
CVE-2025-20892
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability...
CVE-2025-22653
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through = 1.4.6...
CVE-2025-22701
Server-Side Request Forgery SSRF vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through 1.4...
CVE-2024-56132
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 inclusive From 7.2.49.0 to 7.2.54.12 inclusive 7.2.48.12 and all prior versions ECS All prior...
CVE-2024-20397
A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. This vulnerability is due to insecure...
K000149707: PostgreSQL vulnerability CVE-2024-10976
Security Advisory Description Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a...
Microsoft Identifies 3,000 Leaked ASP.NET Keys Enabling Code Injection Attacks
Microsoft is warning of an insecure practice wherein software developers are incorporating publicly disclosed ASP.NET machine keys from publicly accessible resources, thereby putting their applications in attackers' pathway. The tech giant's threat intelligence team said it observed limited...
RHSA-2025:1075 Red Hat Security Advisory: libsoup security update
Bulletin has no description...
CVE-2025-25111
CVE-2025-25111 (WP Spell Check) is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin WP Spell Check up to version 9.21. The initial document shows a CVSS v3.1 base score of 5.4 (MEDIUM) with metrics: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. Several sources (NVD, Red Hat...
CVE-2025-23755
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through = 2.6.1...
CVE-2025-24574
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through =...
CVE-2025-0509
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s EdDSA signing checks...
CVE-2024-38420
Memory corruption while configuring a Hypervisor based input virtual device...
MAL-2025-1240 Malicious code in afip-example-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af458f37f8afe450febaa14d76f15345bc5fe0f83c274593a481ac82dcc0bad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
DLA-4045-1 thunderbird - security update
Bulletin has no description...