آخرین آسیب‌پذیری‌ها

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Dockhand before 1.0.54 Path Traversal via Stack Environment Routes

svg-sanitizer before 1.1.0 XSS via animateTransform on Safari

svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping

svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser