2741 matches found
Vim 路径遍历漏洞
Vim is a cross-platform text editor from the Vim open source. A path traversal vulnerability exists in versions prior to Vim 9.1.1552, which stems from a path traversal issue in the tar.vim plugin that could lead to arbitrary file overwrites...
CVE-2025-53889
Summary: CVE-2025-53889 affects Directus up to 11.9.0 where manual trigger Flows do not validate whether the triggering user has read permissions for payload items, potentially allowing unauthorized actions. The issue is fixed in 11.9.0; a workaround is to add permission checks for read access to...
CVE-2025-1735
In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid...
CVE-2025-5992
Qt evolves a DoS issue: passing values outside the expected range to QColorTransferGenericFunction can be triggered by a crafted ICC profile used with QColorSpace::fromICCProfile. Affected releases are Qt 6.6.0–6.8.3 and 6.9.0–6.9.1. The vulnerability is fixed in Qt 6.8.4 and 6.9.2. Impact is des...
CVE-2025-37800 affecting package kernel for versions less than 6.6.92.2-1
CVE-2025-37800 affecting package kernel for versions less than 6.6.92.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2025-0624 affecting package grub2 for versions less than 2.06-14
CVE-2025-0624 affecting package grub2 for versions less than 2.06-14. A patched version of the package is available...
CVE-2025-7387
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Golang 1.23.x < 1.23.11 / 1.24.x < 1.24.5 Command Execution
The version of Golang running on the remote host is 1.23.x prior to 1.23.11, 1.24.x prior to 1.24.3. It is, therefore, affected by a command execution vulnerability as referenced in 74380 advisory. - Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code...
Amazon Linux 2 : runc (ALASDOCKER-2025-074)
The version of runc installed on the remote host is prior to 1.2.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-074 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...
GHSA-QF34-QPR4-5PPH docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
GitHub Personal Access Token Exposure in docusaurus-plugin-content-gists Summary docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for...
CVE-2025-6712
MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory...
CVE-2025-5464
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information...
CVE-2025-6713 MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage
An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB...
CVE-2025-6711 Incomplete Redaction of Sensitive Information in MongoDB Server Logs
An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0...
CVE-2025-4779
CVE-2025-4779 affects lunary-ai/lunary prior to version 1.9.24. A stored XSS exists in the v1/runs/ingest endpoint: an unauthenticated attacker can inject JavaScript by sending an empty citations field, triggering a code path that uses dangerouslySetInnerHTML to render attacker-controlled text. I...
Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0709)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0709 advisory. - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103,...
Wikimedia Mediawiki - ApprovedRevs Extension 安全漏洞
Wikimedia Mediawiki - ApprovedRevs Extension is a page versioning extension from the Wikimedia Foundation. A security vulnerability exists in Wikimedia Mediawiki - ApprovedRevs Extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43.2, which stems from a system message that is not...
Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0704)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0704 advisory. - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104,...
CVE-2025-49600
A flaw was found in mbedtls. The mbedtlslmsverify function may accept forged Leighton-Micali signatures when hash computation fails and internal error conditions are not properly checked. This flaw allows an attacker with physical access to create invalid signatures. This issue occurs because...