EUVD-2023-36861

Malicious code in bioql PyPI...

EUVD-2024-1924

Malicious code in bioql PyPI...

EUVD-2023-0078

Malicious code in bioql PyPI...

Pi-Hole Web 4.3.2 < 4.3.3 RCE

The version of Pi-Hole Web running on the remote web server is 4.3.2 prior to 4.3.3. It is, therefore, affected by a remote code execution vulnerability by privileged dashboard users via a crafted DHCP static lease. Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2009-4898

Cross-site request forgery CSRF vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submi...

CVE-2025-31116

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in validhost uses socket.gethostbyname, which is vulnerable to SSRF abuse using DNS rebinding technique. This...

CVE-2025-31116 Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in validhost uses socket.gethostbyname, which is vulnerable to SSRF abuse using DNS rebinding technique. This...

CVE-2025-31116

CVE-2025-31116 relates to Mobile Security Framework (MobSF) and its valid_host() function, where DNS rebinding enables SSRF. The vulnerability arises from using socket.gethostbyname() and local/invalid-prefix checks that can be bypassed, allowing DNS-based host resolution to reach internal resour...

CVE-2025-31116 Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in validhost uses socket.gethostbyname, which is vulnerable to SSRF abuse using DNS rebinding technique. This...

[SECURITY] Fedora 40 Update: jupyterlab-4.3.2-1.fc40

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface...

CVE-2024-8517

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request...

CVE-2024-43163

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This issue affects ParcelPanel: from n/a through 4.3.2...

WordPress ParcelPanel plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin ParcelPanel versions = 4.3.2...

CVE-2024-29038 affecting package tpm2-tools for versions less than 4.3.2-2

CVE-2024-29038 affecting package tpm2-tools for versions less than 4.3.2-2. A patched version of the package is available...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

PT-2024-28017 · Irods · Irods

Name of the Vulnerable Software and Affected Versions: iRODS versions prior to 4.3.2 Description: The issue arises when irodsServerMonPerf attempts to use a path even if it is not a directory. This can lead to unintended behavior. Recommendations: For versions prior to 4.3.2, update to version...

CVE-2024-38462

iRODS before 4.3.2 contains a vulnerability in msiSendMail with a problematic dependency on the mail binary (mailMS.cpp#L94-L106). Affected: versions prior to 4.3.2. Remediation: upgrade to 4.3.2 or later. No exploitation details are provided in the documents.

CVE-2024-38462

iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cppL94-L106 reference...

PT-2024-31911 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: AppPresser plugin for WordPress versions up to, and including, 4.3.2 Description: The issue arises from improper missing encryption exception handling on the decrypt value and doCookieAuth functions. This allows unauthenticated attackers to l...