База данных уязвимостей CVE

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service …

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty …

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when …

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 …

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can …

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, …

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local …

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.