CVE-2024-57973

In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl-totlen" variable is controlled by the user. It comes from processresponses. On 32bit systems, the "gl-totlen + sizeofstruct cplpassacceptreq + sizeofstruct rssheader...

CVE-2024-57973 rdma/cxgb4: Prevent potential integer overflow on 32bit

In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl-totlen" variable is controlled by the user. It comes from processresponses. On 32bit systems, the "gl-totlen + sizeofstruct cplpassacceptreq + sizeofstruct rssheader...

GHSA-HW62-58PR-7WC5 DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace

!NOTE This advisory was originally emailed to [email protected] by @nsysean. To sum it up, the use of javascript's .replace opens up to potential XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from solid-meta are...

CVE-2025-26977

Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Filebird: from n/a through 6.4.2.1...

PT-2025-7870 · Amelia · Amelia

Name of the Vulnerable Software and Affected Versions: Amelia versions 1.2.16 and earlier Description: The issue affects Amelia due to an Authorization Bypass Through User-Controlled Key vulnerability, which exploits incorrectly configured access control security levels. Recommendations: For...

PT-2025-7875 · Ninja Team · Filebird

Name of the Vulnerable Software and Affected Versions: Ninja Team Filebird versions 6.4.2.1 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key, which can be exploited due to incorrectly configured access control security levels. Recommendations: F...

CVE-2024-55898 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege...

Grafana Authentication Bypass

The vulnerability of the Grafana data processing web tool relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of the protected information...

CVE-2025-27108

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...

CVE-2025-27108 Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressions

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...

CVE-2025-27108

CVE-2025-27108 affects dom-expressions. The vulnerability arises from using JavaScript String.replace with special replacement patterns (notably $' and $�60) when injecting assets into HTML headers via solid-meta, where user-controlled attributes (Meta tags) can be manipulated to achieve XSS. Thi...

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

CVE-2024-12651

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651

CVE-2024-12651 affects the PTT HGS Mobile App prior to version 6.5.0. The issue is an Exposed Dangerous Method or Function vulnerability that allows manipulating user-controlled variables. The NVD/NIST record lists a CVSS v3.1 base score of 8.5 (HIGH) with Network attack vector, Low privileges re...

CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0...

PT-2025-6533

Name of the Vulnerable Software and Affected Versions BSS Software Mobuy Online Machinery Monitoring Panel versions prior to 2.0 Description The issue affects BSS Software Mobuy Online Machinery Monitoring Panel, allowing SQL Injection due to an Authorization Bypass Through User-Controlled SQL...

CVE-2024-12651: Exposed Dangerous Method or Function

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...