66 matches found
Important: pcs
Issue Overview: Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers the entire multipart preamble bytes before the first boundary in memory without any size limit. A client can send a large preamble followed by a valid...
CVE-2025-57352
The min-document package prior to version 2.19.0 is vulnerable to a prototype pollution vulnerability (CWE-1321) due to improper handling of namespace operations in the removeAttributeNS method. An attacker can provide malicious input involving the proto property to manipulate the prototype c...
CVE-2025-28041
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...
Exploit for CVE-2025-46018
CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Byp...
Opay Mobile application 安全漏洞
Opay Mobile application is a lightweight application from Opay Inc. It is used to manage all banking or payment requirements. A security vulnerability exists in Opay Mobile application version 2.19.4, which originated from allowing a user to bypass payment authorization by disabling Bluetooth at ...
CVE-2025-45607
An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...
iTranswarp 安全漏洞
iTranswarp is a full-featured CMS by Crypto Michael Individual Developers. A security vulnerability exists in iTranswarp version v2.19, which stems from improper component/manage/authentication and could lead to bypassing authentication...
CVE-2025-25205
Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings lik...
PT-2024-16595 · Wpdevart · Wpdevart Booking Calendar
Name of the Vulnerable Software and Affected Versions: Booking Calendar WpDevArt plugin versions up to, and including, 3.2.19 Description: The issue is a time-based, blind SQL injection vulnerability via the id parameter in the "wpdevart booking calendar" shortcode. This vulnerability is due to...
Exploit for CVE-2024-54160
CVE-2024-54160-Opensearch-HTML-Injection + Stored XSS It w...
PT-2024-32381 · Unknown · Computer Vision Annotation Tool
Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. A malicious CVAT user with permissions to create or edi...
SUSE CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 November 2016...
PT-2023-7904 · WordPress · User Post Gallery
Name of the Vulnerable Software and Affected Versions: User Post Gallery WordPress plugin versions 2.19 and earlier Description: The issue is related to insufficient authorization procedure in the User Post Gallery WordPress plugin, allowing remote attackers to execute arbitrary code. This is...
DEBIAN-CVE-2022-23514
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...
DEBIAN-CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a...
UBUNTU-CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a...
GeoServer 代码问题漏洞
GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer that originates from an option that allows SSRF to set up proxy hosts through. The following products and versions are affected: versions...
Spring Expression DoS Vulnerability
In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...
PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...