Drupal Full Path Disclosures

Drupal versions prior to 10.2.9, 10.3.x 10.3.6 and 11.0.x 11.0.5 are affected by Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. No source data...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Linux - Version Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

CVE-2025-23001

CVE-2025-23001 affects CTFd 3.7.5. The vulnerability is a Host header injection caused by insufficient validation/sanitization of the Host header in HTTP requests. Potential impacts include phishing, password reset manipulation, and cache poisoning as described in multiple sources. Some entries n...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

Snowflake Connector for Python 代码问题漏洞

Snowflake Connector for Python is an open source interface from Snowflake Computing. It is used to develop Python applications that can connect to Snowflake and perform all standard operations. A code issue vulnerability exists in Snowflake Connector for Python versions prior to 3.13.1, which ste...

CVE-2025-24120

creationtimestamp| type| source ---|---|--- 2025-01-27 22:17:52+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxtbsql52n 2025-02-01 17:28:10+00:00| seen| Telegram/tFhyawYIJsXL5Gu7MQSiRHwfuZSkuaAStMyrTyTQCntsEvFP 2026-04-02 22:13:16+00:00| seen|...

CVE-2024-54557

creationtimestamp| type| source ---|---|--- 2025-01-27 22:16:50+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxrgfgkf2e 2025-01-31 23:25:01+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3694...

PT-2025-3105 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 21.0.0-beta Description: A cross-site scripting XSS issue in the Events/Agenda module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter. This enables attackers t...

Important: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

CVE-2024-42187 HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability

BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks...

CVE-2025-21550

...

CVE-2024-6466

NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified...

Scaling Dynamic Application Security Testing (DAST)

Introduction Microsoft engineering teams use the Security Development Lifecycle to ensure our products are built in alignment with Microsoft’s Secure Future Initiative security principles: Secure by Design, Secure by Default, and Secure Operations. A key component of the Security Development...

CVE-2025-23220

The CVE pertains to WeGIA, an open-source web manager for welfare organizations. A SQL Injection exists in the adicionar_raca.php endpoint (parameter raca), allowing attackers to execute arbitrary SQL and potentially dump the database. This vulnerability has a critical impact (high confidentialit...

CVE-2024-57907

creationtimestamp| type| source ---|---|--- 2025-01-19 11:58:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2345 2025-01-19 12:15:47+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lg3shd2rjy2f 2025-02-18 21:11:31+00:00| seen|...

CVE-2025-21606 Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats

stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name eu.exelban.Stats.SMC.Helper. The associated binary,...

CVE-2024-39370

creationtimestamp| type| source ---|---|--- 2025-01-14 15:17:06+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpkaw45ul2f...

CVE-2025-0066 Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)

Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform Internet Communication Framework allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application...

CVE-2025-23027

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...