PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
CVE-2022-51017
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, all
#cwe-20
共收录 1723 条相关情报。
← 返回所有主题PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
CVE-2022-51015
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK action
PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
CVE-2022-51013
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received fro
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
CVE-2022-51012
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transac
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
CVE-2022-51011
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by n
PocketMine-MP before 4.4.2 Server Crash via Item ID
CVE-2022-51010
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Atta
MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
CVE-2026-86440
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative ...
CVE-2026-86351
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.
CVE-2025-52651
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause u
MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
CVE-2026-86351
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma ...
CVE-2026-50553
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug val
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
CVE-2026-50553
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug val
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the intercept...
CVE-2026-84947
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that p...
CVE-2026-84504
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protoco
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema tha...
CVE-2026-84469
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schem
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be red...
CVE-2026-85528
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the ...
CVE-2026-85047
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote at
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definiti...
CVE-2026-85239
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify even
MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
CVE-2026-85239
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify even
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered a...
CVE-2026-85230
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge