CVE-2025-51529

Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server resource exhaustion via unlimited database write operations to the...

External Control of File Name or Path

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to External Control of File Name or Path via the write and join method, which used the fullPath method to create the absolute path. An attacker can upload...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.9 bug fix and security update

Red Hat OpenShift Container Platform release 4.19.9 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

PT-2025-34111 · Undefined · Undefined

Foxit PDF Reader 4.3.1.0218 exposes a JavaScript API function, createDataObject, that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code...

ROS-20250819-05

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...

CVE-2025-51529

Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server resource exhaustion via unlimited database write operations to the...

CVE-2025-51529

Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server resource exhaustion via unlimited database write operations to the...

CVE-2025-51529

CVE-2025-51529 affects the WordPress plugin “jonkastonka Cookies and Content Security Policy” up to version 2.29. The vulnerability is an incorrect access control in the AJAX endpoint function cacsp_insert_consent_data, exposed via wp-admin/admin-ajax.php with wp_ajax_nopriv_ and no authenticatio...

CVE-2025-5296

Schneider Electric SESU (Software Update) contains CWE-59: Improper Link Resolution Before File Access ('Link Following'). A low-privileged attacker who tampers with the installation folder could cause arbitrary data to be written to protected locations, potentially enabling privilege escalation,...

CVE-2025-5296

CWE-59: Improper Link Resolution Before File Access 'Link Following' vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, exposure of application and system information or persistent...

Copier 路径遍历漏洞

Copier is a Copier open source library for rendering project templates. A path traversal vulnerability exists in Copier versions prior to 7.1.0 through 9.9.1, which stems from the fact that templates can be written to files outside of the target path, potentially leading to arbitrary file...

CVE-2025-38522 sched/ext: Prevent update_locked_rq() calls with NULL rq

In the Linux kernel, the following vulnerability has been resolved: sched/ext: Prevent updatelockedrq calls with NULL rq Avoid invoking updatelockedrq when the runqueue rq pointer is NULL in the SCXCALLOP and SCXCALLOPRET macros. Previously, calling updatelockedrqNULL with preemption enabled coul...

Linux Distros Unpatched Vulnerability : CVE-2025-21853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freezemutex during mmap operation We use map-freezemutex to prevent races...

Linux Distros Unpatched Vulnerability : CVE-2021-47055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOC...

Linux Distros Unpatched Vulnerability : CVE-2021-4197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less...

CVE-2025-4277 Tcg2Smm: improper input validation may lead to arbitrary code execution

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

CVE-2025-4276 UsbCoreDxe: improper input validation may lead to arbitrary code execution

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

PT-2025-32958

Name of the Vulnerable Software and Affected Versions: Tcg2Smm affected versions not specified Description: Tcg2Smm contains a flaw that allows writing arbitrary memory inside SMRAM and executing arbitrary code at the SMM level. Recommendations: At the moment, there is no information about a newe...

Exploit for CVE-2025-51529

CVE-2025-51529: WordPress Cookies and Content Security Policy...

GHSA-WCMW-8XPP-RWFJ Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing...