Apache Traffic Server has a vulnerability related to input validation errors.

The Apache Traffic Server versions 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 have a input validation vulnerability. This vulnerability arises when the source server returns the connection back to the shared pool while it is still waiting for a request body that was not fully...

GPAC MP4Box security vulnerability

Versions of GPAC MP4Box 2.5 prior to the current version contain security vulnerabilities. These vulnerabilities stem from a segmentation violation in the checkmediaprofile function, which could allow attackers to cause denial-of-service attacks by providing specially crafted MP4 files...

GPAC MP4Box security vulnerability

Versions of GPAC MP4Box 2.5 prior to the current version contain security vulnerabilities. These vulnerabilities stem from the use of the gffilterpidsendeventdownstream function /filtercore/filterpid.c, where a stack reutilization issue exists after the heap is released. This could allow attacker...

GPAC MP4Box security vulnerability

Versions of GPAC MP4Box 2.5 prior to a certain date contained a security vulnerability. This vulnerability stemmed from a null pointer dereferencing in the dasherinserttimelineentry function /filters/dasher.c. Attackers could exploit this vulnerability by providing a specially crafted MP4 file,...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.1 have a buffer error vulnerability. This vulnerability stems from the DVIADPCM block-aligning arithmetic operations in the rdpnsndserverselectformat function of the server’s rdpnsnd channel. Integer round-off occurs, and validations are bypassed. A malicious RDP...

Apple macOS Buffer Error Vulnerability

Apple macOS Sequoia versions prior to 15.8 and macOS Tahoe versions prior to 26.7 have a buffer error vulnerability. This vulnerability stems from an out-of-bounds write issue, which may cause the application to terminate unexpectedly...

tox-dev filelock: Input validation error vulnerability

The tox-dev filelock version 4.2.1 and earlier contain a vulnerability related to input validation errors. This vulnerability arises when UnixFileLock allows another local user to have the permission to rename files, or when files are hard-linked to lock paths using a relaxed hard-link strategy. ...

tox-dev filelock: Input validation error vulnerability

The tox-dev filelock version 3.22.0 to 4.2.1 prior to version 4.2.1 has a vulnerability related to input validation errors. This vulnerability stems from a forged process identifier in the SoftFileLock trust mark, which can be modified by an attacker. This could allow authorized actors to act as ...

Froxlor authorization issue vulnerability

Froxlor versions 0.10.0 to 2.3.15 have an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the Admins.get API command. Attackers can exploit this vulnerability by using identifier obfuscation, sending their login name along with the digital ID of another...

Mozilla Firefox security vulnerabilities

Mozilla Firefox has a security vulnerability, which stems from incorrect boundary conditions of SVG components...

Vitest information leakage vulnerability

The Vitest versions 5.0.0-beta.6 to 5.0.5 contain security vulnerabilities. This vulnerability stems from an error in the development server’s application server.fs.deny file. The project server replaces the Vite default value, and the root server adds.vitest-secret-token after the Vite compilati...

Apple iOS Permission Licensing and Access Control Vulnerabilities

Versions of Apple’s operating systems and devices that are not up to version 26.7 including Apple iOS before version 26.7, Apple iPadOS before version 26.7, Apple iOS 27 before version 27, Apple iPadOS 27 before version 27, Apple macOS Golden Gate 27 before version 27, and Apple VisionOS 27 befor...

Apple macOS race condition bug

Versions of Apple macOS Golden Gate prior to version 27 have a race condition vulnerability. This vulnerability arises due to race conditions, which may cause the application to cause unexpected system termination...

Advantech Adam-3600 code injection vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a code injection vulnerability. This vulnerability stems from code injection, and it may allow remotely authenticated attackers to execute arbitrary code with service privileges...

Flatpak path traversal vulnerability

Versions of Flatpak prior to 1.18.1 contain a path traversal vulnerability. This vulnerability arises when a system is configured with at least one OCI remote, allowing malicious local users to exploit a specially crafted architecture name to trick the flatpak-system-helper process into creating ...

XERJ Organization: XERJ Authorization Issues Vulnerability

The XERJ v1.0.0-rc.11 version has an authorization issue vulnerability. This vulnerability arises from the Bearer token being able to bypass the identity verification requirements of the restricted access key and directly call the API token to create endpoints. This may lead to the generation of...

TYPO3 sgalinski Cookie Consent Authorization Vulnerability

In versions of TYPO3 from 8.0.0 to 8.1.12, as well as 7.4.6, there is a vulnerability related to authorization. This vulnerability arises from not adhering to backend user permissions when importing JSON configurations for Cookie Consent. Backend users who have module access rights can import...

TYPO3 sgalinski Cookie Consent Authorization Vulnerability

TYPO3 versions prior to 8.0.0 through 8.1.12 and 7.4.6 contain an authorization vulnerability. This vulnerability stems from the fact that the function for providing consent and statistical data does not check whether the backend users have permission to access the requested modules or pages. As ...

Apple Safari buffer error vulnerability

Versions of Apple's software prior to Safari 27, Apple's iOS before version 27, Apple's iPadOS before version 27, Apple's macOS Golden Gate before version 27, and Apple's visionOS before version 27 have a buffer error vulnerability. This vulnerability stems from a type confusion issue, and...

Apostrophe Technologies ApostropheCMS Cross-site Scripting Vulnerability

Apostrophe Technologies ApostropheCMS versions prior to 4.34.0 have a cross-site scripting vulnerability. This vulnerability stems from the TinyColor validation for the color field, which does not require the entire value to match the color. Certified users with editing privileges can store...

EventON – Subscriber SQL injection vulnerability

EventON – Subscriptions versions 1.4.5 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the email parameters and inadequate preparation for existing SQL queries. It may allow unauthenticated attackers to append additional SQL queries to existi...

Advantech Adam-3600: Improper exception handling leads to vulnerabilities

The Advantech Adam-3600 versions prior to 2.8.5.0 have a vulnerability in exception handling. This vulnerability allows attackers to send specially crafted messages to trigger assertion failures, resulting in service crashes...

Apple macOS Permission Licensing and Access Control Vulnerabilities

Versions of Apple macOS Golden Gate prior to version 27 have vulnerabilities related to permission management and access control. These vulnerabilities stem from insufficient sandbox restrictions, which may allow applications to access user contact information...

Apple macOS Information Leakage Vulnerability

Versions of Apple macOS Golden Gate prior to version 27 have a vulnerability known as information leakage. This vulnerability arises from the removal of code that contained the vulnerability, which may lead to the application leaking kernel memory...

Apple iOS Resource Management Vulnerability

Apple iOS versions prior to 26.7, Apple iPadOS versions prior to 26.7, Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia 15.8 versions prior to 27, Apple macOS Tahoe versions prior to 26.7, Apple tvOS versions prio...

Apple macOS Security Vulnerabilities

Versions of Apple macOS Golden Gate prior to version 27 contain security vulnerabilities. These vulnerabilities stem from insufficient integrity checks on application packages, which may allow maliciously modified applications to be launched without being prevented...

Apple macOS Security Vulnerabilities

Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia versions prior to 15.8, and Apple macOS Tahoe versions prior to 26.7 have security vulnerabilities. These vulnerabilities stem from authentication issues, which may allow attackers to impersonate other users...

Apple iOS Authorization Issue Vulnerability

Versions of Apple iOS prior to version 27 and Apple iPadOS prior to version 27 have a licensing issue vulnerability. This vulnerability stems from state management issues, which may allow attackers with physical access to locked devices to bypass Digital ID authentication when iPhone Mirroring is...

Apostrophe Technologies ApostropheCMS: Vulnerabilities in Permissions Management and Access Control

Apostrophe Technologies' ApostropheCMS has a security vulnerability. This vulnerability arises from authenticated users who have permission to import target types being able to use objects or operators as update key values. As a result, import queries may match with unrecognized existing document...

Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability

Apostrophe Technologies’ ApostropheCMS versions prior to 4.33.0 have a licensing issue vulnerability. This vulnerability stems from the REST API used in core pages, which reads the complete page documentation using .permissionfalse during tree dumps. This bypasses checks for page types such as...

Apostrophe Technologies ApostropheCMS information leakage vulnerability

Apostrophe Technologies' ApostropheCMS has a vulnerability related to information leakage. This vulnerability arises from the practice of placing the one-time session token in the redirect URL during cross-host or cross-region session migrations. This allows attackers to obtain and exchange token...

Letta encryption problem vulnerabilities

Letta versions 0.16.8 and earlier have encryption-related vulnerabilities. This vulnerability stems from the LocalSandbox sub-process inheriting the entire server environment. Attackers can exploit this by running code via POST /v1/tools/run or custom tools, thereby reading LETTAPGURI,...

Apple Xcode security vulnerabilities

Versions of Apple Xcode prior to Xcode 27 contain security vulnerabilities. These vulnerabilities stem from the lack of forced library verification for affected binary files, which may allow applications to bypass the sandbox...

Agent2Agent A2A Java SDK configuration error vulnerability

The Agent2Agent A2A Java SDK versions prior to 1.3.0.Final contain a security vulnerability. This vulnerability stems from the default InMemoryTaskStore configuration, which does not authorize task reads. Additionally, InMemoryTaskStore.get does not check the caller or owner of the call, and the...

Advantech Adam-3600 buffer error vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer overflow vulnerability. This vulnerability stems from a stack buffer overflow in the log settings function, which could allow authenticated attackers to execute arbitrary code...

Apostrophe Technologies ApostropheCMS Cross-site Scripting Vulnerability

Apostrophe Technologies' ApostropheCMS has a cross-site scripting vulnerability. This vulnerability arises from application configurations that allow SVG animation elements with namespace prefixes and related URL location attributes. When these prefixed tag names do not match the prefixless...

ATSUMI Electric ADX5004: Processing logic error vulnerability

The ATSUMI Electric ADX5004 has a processing logic vulnerability, which stems from a hidden function issue. This vulnerability could allow logged-in users with administrative privileges to upgrade affected products to unauthorized firmware...

Memo authorization issue vulnerabilities

Versions of Memos prior to 0.27.0 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization checks in the ActivityService’s ListActivities and GetActivity API methods. Low-privilege attackers can enumerate consecutive activity IDs, obtain the creator I...

Froxlor Postback Link Vulnerability

Versions of Froxlor prior to 2.3.15 had a post-linkage vulnerability. This vulnerability stemmed from a symbolic link issue in the Statistics::makeChownWithNewStats function. Certified customers can exploit this vulnerability by using a root account to run a cron job that replaces the goaccess...

Stormshield Network Security Authorization Issue Vulnerability

Stormshield Network Security versions 4.3.0 to 4.3.44, 4.8.0 to 4.8.19, 5.0.0 to 5.0.9, and 5.1.0 to 5.1.3 have an authorization issue vulnerability. This vulnerability arises from a failure in the dynamic data file signature check; there are logical errors in the signature verification routine,...

Stirling Tools Stirling PDF licensing issue vulnerability

Stirling Tools’ Stirling PDF version 3.0.0 to 3.2.0 has an authorization vulnerability. This vulnerability stems from an authorization bypass, allowing authenticated users to access other users’ storage files by directing processing folders to the server’s storage directory. Attackers can create ...

TYPO3 FAL Protect authorization issue vulnerability

The TYPO3 FAL Protect version 1.7.1 up to 1.8.2 had an authorization issue vulnerability. This vulnerability stemmed from extensions not applying access protection to files stored in file storage that used non-default relative base paths. As a result, these files were directly provided by the web...

Stormshield Network Security Cross-Site Scripting Vulnerabilities

Stormshield Network Security versions 4.8.19 and earlier of 4.8.x, 5.0.9 and earlier of 5.0.x, and 5.1.3 and earlier of 5.1.x have a cross-site scripting vulnerability. This vulnerability stems from the captive portal of the SNS enrollment Portal failing to properly filter inputs when creating...

WordPress Brizy Cross-Site Script Vulnerability

WordPress Brizy 2.8.23 has a cross-site scripting vulnerability, which stems from improper input during web page generation. This vulnerability may lead to storage-based cross-site scripting attacks...

WordPress WP User Manager Authorization Vulnerability

WordPress WP User Manager 2.9.25 and earlier versions have a vulnerability related to authorization. This vulnerability arises from a lack of authorization checks, which may lead to manipulation of user status...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition issue. This issue stemmed from the SoftReadWriteLock and AsyncSoftReadWriteLock classes’ caching mechanism for checking the .rw lock tree successfully, and then re-reshaping its name during subsequent recording operations. This coul...

Nokia 1830 Global Express security vulnerabilities

The Nokia 1830 Global Express G42, GX G31, GX G32, and GX G34 models prior to the GX r9.0 version have security vulnerabilities. These vulnerabilities stem from bypassing CLI ACLs. Low-privilege authenticated attackers can circumvent the SSH isolation mechanism through custom SSH commands, thereb...

DrayTek Vigor2960 path traversal vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a path traversal vulnerability. This vulnerability stems from the handling of the 'action' parameter in the '/cgi-bin/mainfunction.cgi' file within component Apmupload, allowing for path traversal attacks. Attackers can exploit this vulnerability remote...

DrayTek Vigor2960: Input validation error vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a security vulnerability. This vulnerability stems from the incorrect handling of parameters in the option field of the ruequestcertificate function in the /cgi-bin/mainfunction.cgi file within the IPsec Handler component. This could lead to remote...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization verification in the ajax/testEmailSettings.php file. Users with read permissions can send test emails to any recipient by providing the parameters...