16949 matches found
BELL-CVE-2025-38278
Bulletin has no description...
BELL-CVE-2025-38280
Bulletin has no description...
PT-2025-29329 · Unknown · Modern Bag
Name of the Vulnerable Software and Affected Versions: Modern Bag version 1.0 Description: A critical issue exists in Modern Bag 1.0, specifically within the /admin/category-list.php file. Manipulation of the idCate argument can lead to a SQL injection. This allows for remote attacks. The exploit...
GHSA-XRRQ-RRGQ-H89W static-alloc vulnerability leads to uninitialized read after allocating MemBump
The affected function, MemBump::new, would allocate memory without initializing it. Subsequently calling the created value's various allocmethods would then read and write the start of that memory as a Cell which isundefined behavior. Instead, it should zero initialize the start of the allocated...
CVE-2025-53641 Postiz allows header mutation in middleware facilitates resulting in SSRF
Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery SSRF condition, which can be exploited to initiate unauthorized...
GHSA-Q745-CFQH-HCRW phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function
gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...
RUSTSEC-2025-0042 Uninitialized read after allocating MemBump
The affected function, MemBump::new, would allocate memory without initializing it. Subsequently calling the created value's various alloc methods would then read and write the start of that memory as a Cell which is undefined behavior. Instead, it should zero initialize the start of the allocate...
MAL-2025-6558 Malicious code in node-db-indicator (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7c9a18fe9ea04133e7de33313046092ffb5e8ccef6c1bf5f44e9b6d5e3835aa2 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category...
Hash Collision Attack
llamaindex is vulnerable to Hash Collision Attack. The vulnerability is due to the use of MD5 hashing for generating document chunk IDs, which allows an attacker to exploit hash collisions by creating structurally distinct chunks with identical text...
BELL-CVE-2025-38338
Bulletin has no description...
BELL-CVE-2025-38328
Bulletin has no description...
BELL-CVE-2025-38344
Bulletin has no description...
BIT-MARIADB-MIN-2023-39593
Insecure permissions in the sysexec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed...
BIT-DOTNET-2025-30399 .NET and Visual Studio Remote Code Execution Vulnerability
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network...
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the...
OSV-2025-544 Heap-buffer-overflow in N_BELE_RTP::LEPolicy::get32
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110068 Crash type: Heap-buffer-overflow READ 4 Crash state: NBELERTP::LEPolicy::get32 PackLinuxElf32::elflookup PackLinuxElf32::PackLinuxElf32help1...
PT-2025-29245
Name of the Vulnerable Software and Affected Versions: Apache Commons Lang versions 2.0 through 2.6 Apache Commons Lang3 versions 3.0 through 3.17.9 Description: The ClassUtils.getClass method can cause a StackOverflowError when processing excessively long inputs. This error can lead to applicati...
PT-2025-29206 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue has been rejected as not used. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...
Emerson ValveLink Products 安全漏洞
Emerson ValveLink Products is a diagnostic software from Emerson USA. A security vulnerability exists in Emerson ValveLink Products, which stems from an inadequate protection mechanism that makes it susceptible to targeted attacks...