| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; never assigned. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. |
| A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data. |
| My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values. |
