34905 matches found
MiracleLinux 7 : kernel-3.10.0-327.22.2.el7 (AXSA:2016-613:04)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-613:04 advisory. Security issues fixed with this release: CVE-2015-8767 net/sctp/smsideeffect.c in the Linux kernel before 4.3 does not properly manage the relationsh...
Qnap QTS and QuTS hero Use of Externally-Controlled Format String (CVE-2025-53407)
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...
MiracleLinux 4 : glibc-2.12-1.166.AXS4.7 (AXSA:2016-091:01)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-091:01 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make...
MiracleLinux 3 : net-snmp-5.3.2.2-20.0.1.AXS3 (AXSA:2013-32:01)
The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-32:01 advisory. SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an SN...
MiracleLinux 7 : glusterfs-3.8.4-54.10.el7 (AXSA:2018-3234:05)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3234:05 advisory. GlusterFS is a key building block of Asianux Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for divers...
MiracleLinux 7 : mariadb-5.5.64-1.el7 (AXSA:2019-4127:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4127:01 advisory. mysql: MyISAM unspecified vulnerability CPU Jul 2018 CVE-2018-3058 mysql: Server: Security: Privileges unspecified vulnerability CPU Jul 2018...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004260)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004260 advisory. A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabl...
CVE-2026-1011
A stored cross-site scripting XSS vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST...
CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
GHSA-F2PH-GC9M-Q55F lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()
A use-after-free vulnerability was found in the Ceph client session initialization in the Linux kernel. The havemonandosdmap function checks map epochs without holding the appropriate locks, racing with concurrent map updates that free the old map. This can result in dereferencing freed memory...
Tagstoo Cross-Site Scripting Vulnerability
Tagstoo is a tag-based file manager developed by Pablo Andueza. Version 2.0.1 of Tagstoo contains a cross-site scripting vulnerability. This vulnerability arises from improper handling of file or custom tag inputs, which may lead to storage-based cross-site scripting attacks...
Altium 365 security vulnerabilities
Altium 365 is a product design and development platform provided by the American company Altium. There is a security vulnerability in Altium 365, which stems from the lack of server-side input validation in the workflow form submission API. This vulnerability may lead to storage-based cross-site...
Each Italy Wireless Mini Router WIRELESS-N 300M has security vulnerabilities
The Each Italy Wireless Mini Router WIRELESS-N 300M is a wireless router produced by Each Italy. There is a security vulnerability in the version v28K.MiniRouter.20190211 of the Each Italy Wireless Mini Router WIRELESS-N 300M. This vulnerability stems from the lack of cleaning of the repeater AP...
lakeFS security vulnerability
LakeFS is an open-source tool developed by Treeverse. It allows you to convert your object storage into a repository similar to Git. Versions of LakeFS prior to 1.75.0 contained security vulnerabilities. These vulnerabilities stemmed from the S3 gateway not verifying the timestamps in authenticat...
PT-2026-3139
Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.75.0 Description lakeFS's S3 gateway does not validate timestamps in authenticated requests, which allows for replay attacks. An attacker capturing a valid signed request can replay it until credentials are rotated,...
PT-2026-3144
A stored cross-site scripting XSS vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003476)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003476 advisory. The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service out-of- bounds read and system crash or possibly have unspecified...