1949 matches found
CVE-2025-32428 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still...
PT-2025-16223
Name of the Vulnerable Software and Affected Versions: ghostxbh uzy-ssm-mall version 1.0.0 Description: A vulnerability was found in the processing of the file /product, where the manipulation of the product name argument leads to cross-site scripting. The attack may be initiated remotely...
GO-2025-3598 bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta
bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta...
BELL-CVE-2025-29087
Bulletin has no description...
BELL-CVE-2025-32364
Bulletin has no description...
PT-2025-15166 · Mediatek +1 · Mt6890 +7
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: In the wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User...
CVE-2025-32358
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This coul...
BELL-CVE-2025-21999
Bulletin has no description...
PT-2025-14946 · Unknown · Morgan Kay Chamber Dashboard Business Directory
Name of the Vulnerable Software and Affected Versions: Morgan Kay Chamber Dashboard Business Directory versions 3.3.11 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that...
BELL-CVE-2025-21912
Bulletin has no description...
PT-2025-14728 · Unknown · Support Helpdesk Ticket System Lite
Name of the Vulnerable Software and Affected Versions: Support Helpdesk Ticket System Lite versions through 4.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks...
BELL-CVE-2025-21915
Bulletin has no description...
BELL-CVE-2025-21925
Bulletin has no description...
BELL-CVE-2025-21920
Bulletin has no description...
BELL-CVE-2025-21918
Bulletin has no description...
Ouch Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability
A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convertzipdatetime of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploi...
CVE-2025-21934 rapidio: fix an API misues when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rioaddnet fails rioaddnet calls deviceregister and fails when deviceregister fails. Thus, putdevice should be used rather than kfree. Add "mport-net = NULL;" to avoid a use after free issue...
Malformed MongoDB wire protocol messages may cause mongos to crash
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to...
PT-2025-14413 · Unknown · Notfound Delete Post Revision
Name of the Vulnerable Software and Affected Versions: NotFound Delete Post Revision versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables an attacker ...