2141 matches found
Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Summary This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes \ - the endpoint still issues a server-side fetch. PoC...
GHSA-QCPR-679Q-RHM2 Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Summary This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes \ - the endpoint still issues a server-side fetch. PoC...
CVE-2025-57521
CVE-2025-57521 affects Bambu Studio 2.1.1.52 and earlier. The vulnerability arises at application startup when the program loads a network plug‑in without validating its digital signature or verifying authenticity. A local attacker can place a malicious component in the expected location (e.g., u...
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Impact Wrong usage of the PHP arraysearch allows bypass of validation. Patches The problem has been patched in versions: - v4.4.1 for PrestaShop 1.7 build number: 7.4.4.1 - v4.4.1 for PrestaShop 8 build number: 8.4.4.1 - v5.0.5 for PrestaShop 1.7 build number: 7.5.0.5 - v5.0.5 for PrestaShop 8...
Security Bulletin: IBM QRadar Investigation Assistant app for IBM QRadar SIEM includes components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Investigation Assistant app for IBM QRadar SIEM has addressed the applicable CVEs Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a...
PT-2025-42516
Name of the Vulnerable Software and Affected Versions PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 Description A flaw exists in the PrestaShop Checkout module due to incorrect use of the PHP array search function. This improper usage allows bypassing validation, potentially leading to th...
Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2025-1214)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1214 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...
GHSA-5FF5-9FCW-VG88 Astro's `X-Forwarded-Host` is reflected without validation
Summary When running Astro in on-demand rendering mode using a adapter such as the node adapter it is possible to maliciously send an X-Forwarded-Host header that is reflected when using the recommended Astro.url property as there is no validation that the value is safe. Details Astro reflects th...
CVE-2025-61925
CVE-2025-61925 affects Astro (on-demand rendering) where headers x-forwarded-proto and x-forwarded-port are used unsafely to build URLs, enabling URL manipulation that can bypass middleware protections and potentially cause SSRF, cache-poisoning, or URL-based attacks. The issue is discussed acros...
Linux Distros Unpatched Vulnerability : CVE-2025-56200
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL function uses '://' as a delimiter to parse protocols, while...
EUVD-2020-23753
Malware in sbrugna...
EUVD-2012-3292
Malware in sbrugna...
EUVD-2020-23719
Malware in sbrugna...
EUVD-2020-0585
Malware in sbrugna...
EUVD-2019-13488
Malware in sbrugna...
EUVD-2016-2379
Malware in sbrugna...
EUVD-2008-0579
Malware in sbrugna...
EUVD-2019-18877
Malware in sbrugna...