3357 matches found
CVE-2025-10126
CVE-2025-10126 affects the WordPress MyBrain Utilities plugin (mbumap shortcode) up to version 1.0.8. Root cause: insufficient input sanitization and output escaping on user-supplied shortcode attributes, enabling Stored Cross-Site Scripting. Impact: authenticated attackers withContributor+ privi...
[SECURITY] Fedora 41 Update: rust-tracing-subscriber-0.3.20-1.fc41
Utilities for implementing and composing tracing subscribers...
WordPress plugin MyBrain Utilities 跨站脚本漏洞
WordPress MyBrain Utilities plugin is a plugin for enhancing the functionality of your website, mainly for optimizing the performance and user experience. A cross-site scripting vulnerability exists in the WordPress MyBrain Utilities plugin that stems from insufficient input cleanup and output...
PT-2025-37008
Name of the Vulnerable Software and Affected Versions: MyBrain Utilities plugin for WordPress versions up to and including 1.0.8 Description: The MyBrain Utilities plugin for WordPress is susceptible to Stored Cross-Site Scripting through the mbumap shortcode due to inadequate input sanitization...
WordPress MyBrain Utilities plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang in WordPress Plugin MyBrain Utilities versions = 1.0.8...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
PT-2025-36533
Name of the Vulnerable Software and Affected Versions: MONAI versions up to and including 1.5.0 Description: MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The pickle operations function in monai/data/utils.py automatically handles dictionary key-value pairs ending wi...
pwnshop
pwnshop Notes, cheatsheets, shellcode and exploits. Progress: - Utility - Object/Executable file to shellcode converter script: code - Utility - Assembly and link script : code - Utility - Shellcode testing skeleton generator : code - Exit syscall asm: code - Write syscall "Hello world!": code -...
Malicious code in string-modifier-utils (npm)
The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
OESA-2025-2162 binutils security update
Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a family of GNU assemblers, gprof for displaying call graph profile data, ld the GNU linker, nm for listing symbols from object files, objcopy for copying and translating object...
OESA-2025-2163 binutils security update
Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a family of GNU assemblers, gprof for displaying call graph profile data, ld the GNU linker, nm for listing symbols from object files, objcopy for copying and translating object...
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
...
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
...
Malicious code in data-processing-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f5c7542831f6f9fe72a65e436b1f85c10261aac12ceae6f1bcc490afad6d1aaa Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious...
CVE-2025-57052
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decodearrayindexfrompointer function in cJSONUtils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters...
postgresql: PostgreSQL code execution in restore operation
A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pgdump, pgdumpall, and pgrestore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to...
MAL-2025-44705 Malicious code in internal-helper-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
CVE-2025-22406
In bnepuchecksendpacket of bneputils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the request body processing. An attacker can cause the server to crash or become unresponsive by sending excessively large payloads to certain API endpoints, leading to resource...