Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

CVE-2023-43770-POC

CVE-2023-43770 POC Ein Proof-of-Concept für die kürzlich entdeckte Schwachstelle CVE-2023-43770. Roundcube vor 1.4.14, 1.5.x vor 1.5.4 und 1.6.x vor 1.6.3 erlaubt XSS über text/plain E-Mail-Nachrichten mit manipulierten Links aufgrund des Verhaltens von...

CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC per la vulnerabilità XSS persistente CVE-2023-43770 Descrizione Roundcube prima di 1.4.14, 1.5.x prima di 1.5.4 e 1.6.x prima di 1.6.3 consente XSS tramite messaggi di posta elettronica text/plain con collegamenti manipolati a causa del comportamento di...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

PT-2026-66502

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description A Cross-Site Request Forgery CSRF issue exists due to a default CORS Cross-Origin Resource Sharing configuration that permits cross-origin state-changing requests and accepts text/plain...

GHSA-75W3-GMQX-993Q Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Summary Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content typ...

CVE-2026-33533

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server activated with glances -s or glances --server sends Access-Control-Allow-Origin: on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an...

CVE-2026-24885

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery CSRF vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the...

EUVD-2008-6908

Malware in sbrugna...

EUVD-2023-27698

Malicious code in bioql PyPI...

CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

CVE-2010-1420

Cross-site scripting XSS vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file...

SUSE CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

DEBIAN-CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

UBUNTU-CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

Debian dla-3577 : roundcube - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3577 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3577-1 [email protected] https://www.debian.org/lts/security/...