WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the userLogin cancelUri parameter could lead to a cross-site scripting attack...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the LoginWordPress loginForm cancelUri parameter could lead to a cross-site scripting attack...

ROS-20250722-01

Vulnerability of the ComposeQueryEngine function UriQuery.c of the URI parsing and processing library uriparser is related to integer overflow. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code or cause a denial of service...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2025-1821)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate...

GHSA-HFJ7-542Q-8FVV DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Summary An attacker can forge a request to redirect an authenticated user to any arbitrary website. Details On the login page, we have a redirect field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter...

DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Summary An attacker can forge a request to redirect an authenticated user to any arbitrary website. Details On the login page, we have a redirect field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter...

CLSA-2025-1752576917 git: Fix of CVE-2025-48385

CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection...

BIT-GIT-2025-48385 Git alllows arbitrary file writes via bundle-uri parameter injection

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to...

CVE-2025-48385 Git alllows arbitrary file writes via bundle-uri parameter injection

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to...

CVE-2025-48385 Git alllows arbitrary file writes via bundle-uri parameter injection

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to...

CVE-2025-6238

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirecturi' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the...

GHSA-PR9R-GXGP-9RM8 n8n Vulnerable to Denial of Service via Malformed Binary Data Requests

Summary Denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. Impact This is a Denial of Service DoS vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI...

n8n Vulnerable to Denial of Service via Malformed Binary Data Requests

Summary Denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. Impact This is a Denial of Service DoS vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI...

CVE-2025-49595

n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. This allows authenticated attackers to cause service unavailability through malformed...

PT-2025-27798 · N8N · N8N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.99.0 Description: The issue is a Denial of Service vulnerability in the "/rest/binary-data" endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. This allows authenticated attackers to cause...

ruby:3.3 security update

ruby 3.3.8-4 - Upgrade to Ruby 3.3.8. Resolves: RHEL-68632 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. CVE-2025-25186 - Fix Denial of Service in CGI::Cookie.parse. CVE-2025-27219 - Fix userinfo leakage in URIjoin, URImerge and URI+. CVE-2025-27221 rubygem-abrt 0.4.0-1 - Updat...

org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority

A flaw was found in Jetty. The HttpURI class performs insufficient validation on the authority segment of a URI. The HttpURI and the browser may differ on the value of the host extracted from an invalid URI. This combination of Jetty and a vulnerable browser may be vulnerable to an open redirect...

OESA-2025-1701 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Oracle Linux 10 : delve / and / golang (ELSA-2025-7466)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7466 advisory. - golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 - golang: net/http: net/http: sensitive...

CVE-2025-52479

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...