16953 matches found
BELL-CVE-2025-0665
Bulletin has no description...
BELL-CVE-2025-0167
Bulletin has no description...
PT-2025-6006 · Tp Link · Tplink Tl-Wpa 8630
Name of the Vulnerable Software and Affected Versions: TPLINK TL-WPA 8630 version 2.0.4 Build 20230427 Description: An issue in TPLINK TL-WPA 8630 allows a remote attacker to execute arbitrary code via function sub 4256CC, which allows command injection by injecting devpwd. Recommendations: As a...
PT-2025-25433 · Xwiki · Xwiki
Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.3 XWiki versions prior to 17.0.0 Description: XWiki is a generic wiki platform that warns about the execution of "dangerous" macros like malicious script macros authored by a user...
CVE-2024-55215
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register...
CVE-2025-23217 Mitmweb API Authentication Bypass Using Proxy Server
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server bound to :8080 by default to access mitmweb's internal...
Improper Input Validation
Browsershot is vulnerable to Improper Input Validation. The vulnerability is due to improper URL validation due to the setUrl method failing to restrict local file access, allowing an attacker to perform local file inclusion and read sensitive files...
GHSA-FG4M-W35Q-VFG2 @zag-js/core prototype pollution
A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
GHSA-GVWQ-6FMX-28XM node-opcua-alarm-condition prototype pollution vulnerability
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
GHSA-PC47-G7GV-4GPW @rpldy/uploader prototype pollution
A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
@ndhoule/defaults prototype pollution
A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
GHSA-79H2-V6HH-WQ23 @ndhoule/defaults prototype pollution
A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
@tanstack/form-core prototype pollution
A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2021-28493
In Arista's MOS Metamako Operating System software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train...
CVE-2021-37705
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a...
CVE-2021-37649
TensorFlow is an end-to-end open source platform for machine learning. The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference. The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressin...
CVE-2021-31455
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2021-4020
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-4134
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the /inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensiti...