CVE-2024-47605

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payloa...

PT-2025-2773

Name of the Vulnerable Software and Affected Versions: silverstripe-asset-admin versions prior to 5.3.8 silverstripe/framework versions prior to 5.3.8 Description: The issue arises when using the "insert media" functionality, where the linked oEmbed JSON includes an HTML attribute that replaces t...

CVE-2024-47605: Improper Neutralization of Input During Web Page Generation

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payloa...

Silverstripe Asset Admin Module Cross-Site Script Vulnerabilities

Silverstripe Asset Admin Module is an open source asset management module from Silverstripe. A cross-site scripting vulnerability exists in Silverstripe Asset Admin Module, which stems from the fact that HTML is not sanitized until the shortcode is replaced, allowing execution of script loads in...

GLPI Addressing System External Input Authorization Bypass

The vulnerability of the addressing plugin in the GLPI system for managing requests, incidents, and inventory of computer equipment is related to the use of an external controlled input for selecting classes or codes. Exploiting this vulnerability can allow a malicious actor to gain unauthorized...

How Your Business Can Benefit From Combining a DAM and CDN

...

PT-2025-19379 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Debian Linux affected versions not specified Description: The issue concerns a Cross Site Scripting vulnerability via JavaScript injection in an Asset name. Additionally, there are package vulnerabilities in request-tracker5. Recommendations:...

PT-2025-25547 · Assimp +1 · Assimp +1

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions up to 5.4.3 Description: A critical vulnerability has been found in the Open Asset Import Library Assimp. The issue affects the function Assimp::BVHLoader::ReadNodeChannels in the library...

TeamViewer Patch & Asset Management File Deletion

The vulnerability of the TeamViewer Patch & Asset Management software component, which is used for remote control of TeamViewer computers, is related to the improper assignment of permissions for a critical resource. Exploiting this vulnerability could allow an attacker to perform the deletion of...

CVE-2024-55659: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting via the file write. Version 3.1.16 contains a patch for the issue...

CVE-2024-55659

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the "/api/asset/upload" endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting via the file write. Version 3.1.16 contains a patch for the issue...

CVE-2024-47761 GLPI vulnerable to account takeover via the password reset feature

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

CVE-2024-47760 GLPI vulnerable to account takeover via API

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

CVE-2024-47758 GLPI vulnerable to account takeover without privilege escalation through the API

GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue...

GLPI Access Control Vulnerability

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

CVE-2024-12363: Incorrect Permission Assignment for Critical Resource

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management...

TeamViewer security vulnerability

TeamViewer is software from TeamViewer, Inc. for remote access as well as remote control and remote maintenance of computers and other end devices. A security vulnerability exists in TeamViewer prior to version 24.12, which stems from insufficient permissions in the Patch and Asset Management...

PT-2024-36573 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: Siyuan versions prior to 3.1.16 Description: Siyuan is a personal knowledge management system. The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored Cross-Site Scripting via the file write...

CVE-2024-53738

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.8...