12998 matches found
CVE-2025-47790 Nextcloud Server doesn't request second factor after session timeout
Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor...
3rdparty applications can create share links via socket API
None...
Test remote endpoint is not rate limited
None...
Second factor not requested after session timeout
None...
PT-2025-21656 · Nextcloud · Nextcloud Enterprise Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 29.0.15, 30.0.9, and 31.0.3 Nextcloud Enterprise Server versions prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 Description: The issue concerns a bug in session handling. When the...
PT-2025-21600 · Xu Yijie · Grpo-Flat
Name of the Vulnerable Software and Affected Versions: XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856 Description: A vulnerability has been found in the function main of the file grpo vanilla.py. The manipulation leads to deserialization. Local access is required to approach th...
PT-2025-21601 · Code Projects · Code-Projects Employee Record System
Name of the Vulnerable Software and Affected Versions: code-projects Employee Record System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file "/dashboard/getData.php". The manipulation of the keywords argument leads to SQL injection...
PT-2025-21688 · Unknown · Salon Booking Pro
Name of the Vulnerable Software and Affected Versions: Salon Booking Pro versions 10.10.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 10.10.2 an...
PT-2025-21605 · Netdragon · Bohua Netdragon Firewall
Name of the Vulnerable Software and Affected Versions: Bohua NetDragon Firewall version 1.0 Description: A critical issue affects the processing of the file /systemstatus/ip status.php. The manipulation of the subnet argument leads to command injection. The attack may be initiated remotely. The...
PT-2025-21616 · D Link · D-Link Di-7003Gv2
Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A vulnerability has been found in the D-Link DI-7003GV2, affecting an unknown functionality of the file /install base.data. The manipulation leads to information disclosure. The attack...
PT-2025-21621 · D Link · D-Link Di-7003Gv2
Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A critical issue has been found, affecting the function sub 497DE4 of the file /H5/netconfig.asp. This leads to improper authentication. The attack can be initiated remotely...
AZL-61866 CVE-2025-47287 affecting package python-tornado 6.3.3-11
Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...
AZL-61860 CVE-2025-47287 affecting package python-tornado 6.2.0-1
Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...
AZL-61895 CVE-2025-47279 affecting package nodejs18 for versions less than 18.20.3-6
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
CVE-2025-47285
Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, concat may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions...
CVE-2025-47279 undici Denial of Service attack via bad certificate data
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
CVE-2025-47279
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
Sulu vulnerable to XXE in SVG File upload Inspector
Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available...
GHSA-F6RX-HF55-4255 Sulu vulnerable to XXE in SVG File upload Inspector
Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available...
ALPINE-CVE-2025-4516
There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode call in ...