CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493

The vulnerability CVE-2025-48493 affects the Yii 2 Redis extension (yii2-redis) used with Yii Framework 2.0. Prior to version 2.0.20, AUTH credentials are logged in plain text when a connection fails, exposing usernames and passwords to anyone with access to the logs. The issue is mitigated by up...

CVE-2024-29097

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20...

CVE-2025-25119

CVE-2025-25119 is a Cross-Site Scripting vulnerability in the WordPress plugin WooCommerce osCommerce Sync (NotFound)

WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Woocommerce osCommerce Sync versions = 2.0.20...

Cloud Whale PolyBuzz 安全漏洞

Cloud Whale PolyBuzz is an AI chatbot from China's Hao Whale Cloud Computing Cloud Whale. A security vulnerability exists in Cloud Whale PolyBuzz version 2.0.20 that stems from an attacker being able to access sensitive user information by providing a carefully crafted link...

[BSA-120] Security Update for mosquitto

Philippe Coval uploaded new packages for mosquitto which fixed the following security problems: CVE-2024-8376 In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT",...

WordPress PropertyHive Plugin <= 2.0.19 is vulnerable to Cross Site Request Forgery (CSRF)

Software PropertyHive Type Plugin Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8490 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID d53c1264ba06 Credits wesley wcraft Require...

Cross site request forgery (csrf)

The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport function. This makes it possible for unauthenticated attackers to trigger a CSV export via a...

SUSE CVE-2023-3173

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20...

CVE-2023-3173

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20...

CVE-2023-3172

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20...

PT-2023-23433 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.20 Description: The issue is related to Path Traversal in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.20, update to version 2.0.20 or later to resolve the issue...

PT-2023-23440 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.20 Description: The issue is related to improper restriction of excessive authentication attempts in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.20, update to version 2.0.20 ...

CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20...

CVE-2023-3172 Path Traversal in froxlor/froxlor

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20...

CVE-2023-3172 Path Traversal in froxlor/froxlor

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20...

nodejs:16 security, bug fix, and enhancement update

nodejs 1:16.19.1-1 - Rebase to 16.19.1 Resolves: rhbz2153713 Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920 Resolves: CVE-2022-25881 CVE-2022-4904 nodejs-nodemon 2.0.20-3 - Patch bundled glob-parent Resolves: CVE-2021-35065...

CVE-2022-2655

The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...