Archive
21 October 2025
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
Low —
Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer
The safe function `create_ring_buffer` allocates a buffer using `Vec::with_capacity` followed by `set_len`, creating a `Box<[T]>` containing uninitialized memory. This leads to undefined behavior when functions like `write_slices` create typed slices (e.g., `…
-
Low —
orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
The safe function `index_of_ptr` causes undefined behavior when called with an empty slice. The issue occurs in the line `ptr.add(slice.len() - 1)` which underflows when `slice.len()` is 0, creating a pointer with a massive offset. According to Rust's safety …
-
Low 2.7
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supp…
-
Low 2.7
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…
-
Low 3.7
Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that ar…
-
Low 2.7
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-2…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 2.7CVE-2025-53051 Public exploit
Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Supported versions that are affected a…
-
Low —
uv has differential in tar extraction with PAX headers
### Impact In versions 0.9.4 and earlier of uv, tar archives containing PAX headers with file size overrides were not handled properly. As a result, an attacker could contrive a source distribution (as a tar archive) that would extract differently when instal…
-
Low 2.7
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
### Impact This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other servic…
-
Low 2.7
Shopware vulnerable to path traversal via Plugin upload
### Impact Malicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder…
-
Low 3.3
DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference
A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the component dcmqrscp. The manipulation results in null pointer dereference. The attack needs to be appro…
-
Low 1.8
Buffer overwrite when processing file handles with the SFTP server
Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed.
-
Low 3.3
Arbitrary File Deletion
ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.