PT-2025-24442

Name of the Vulnerable Software and Affected Versions Konica Minolta bizhub versions up to 20250202 Description A problematic issue was found in the Display MFP Information List component. The manipulation of the Model Name argument leads to cross-site scripting. It is possible to initiate the...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

VulnCheck KEV: CVE-2025-29306

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2025-49012 Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

Linux kernel DoS

The vulnerability in the drivers/gpu/drm/amd/display/dc/dml/dmlInlinedefs.h module of the Linux operating system is related to the lack of zero-division checking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-5369

A vulnerability classified as critical has been found in SourceCodester PHP Display Username After Login 1.0. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has bee...

NVIDIA GPU Display Driver Unauthorized Access

The vulnerability of the NVIDIA GPU Display Driver software driver is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to data, disclose confidential information, or cause system failures...

CVE-2025-5369

A vulnerability classified as critical has been found in SourceCodester PHP Display Username After Login 1.0. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has bee...

SourceCodester PHP Display Username After Login Security Vulnerability

SourceCodester PHP Display Username After Login is an open source management system from SourceCodester. A security vulnerability exists in SourceCodester PHP Display Username After Login version 1.0, which is caused by a SQL injection due to an incorrect manipulation of the parameter Username in...

CVE-2025-5369: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in SourceCodester PHP Display Username After Login 1.0. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has bee...

WordPress plugin OpenSheetMusicDisplay has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

kernel: drm/dp_mst: Fix resetting msg rx state after topology removal

A flaw was found in the Linux kernel's DisplayPort Multi-Stream Transport DP MST subsystem. A race condition can occur when a DisplayPort device is disconnected while sideband communication messages are actively being processed. A local user or an attacker with physical access to the display port...

Poppler Heap Buffer Overflow DoS

The vulnerability of the Poppler library for displaying PDF files relates to the reading beyond the buffer boundary in the JBIG2Bitmap::combine function. Exploiting this vulnerability can allow an attacker to cause a service failure...

[NetScaler] MPX LCD Display: Understanding Port Status Indicators

This article explains the meaning of the characters/icons shown on the NetScaler MPX LCD display...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Divine Vision Han Technology Co.

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2024-52271

User Interface UI Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed e.g. via Google Chrome - Examine the print preview: Will render the vulnerability only, not all...

CVE-2024-0078

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service...

CVE-2024-7414

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-6562

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due displayerrors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path of the web...