223 matches found
SUSE CVE-2017-18893
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS...
CVE-2023-45809
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...
CVE-2019-16563
Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties...
TrueConf Server 安全漏洞
TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. A security vulnerability exists in TrueConf Server version 5.5.2.10813, which stems from a vulnerability that allows injection of malicious spreadsheet formulas via specially crafted displa...
CVE-2025-12492 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajaxgetmembers function. This is due to the use of a...
CVE-2025-12361
The CVE-2025-12361 entry concerns the WordPress plugin myCred (Points Management System) with vulnerability in versions up to and including 2.9.7.1. The root cause is Missing Authorization: authenticated users with Subscriber-level access and above can access sensitive information via the get_ban...
CVE-2025-12361 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...
Cross Site Scripting
Jenkins Spring Config Plugin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of build display names in the Spring Config view, allowing attackers who can modify build display names to inject malicious scripts that execute in other users' browsers...
CVE-2025-65032
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference IDOR vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the...
EUVD-2019-9665
Malware in sbrugna...
EUVD-2022-7357
Malicious code in bioql PyPI...
EUVD-2024-22162
Malicious code in bioql PyPI...
EUVD-2022-4577
Malicious code in bioql PyPI...
EUVD-2023-1668
Malicious code in bioql PyPI...
EUVD-2022-41818
Malicious code in bioql PyPI...
EUVD-2022-7488
Malicious code in bioql PyPI...
EUVD-2022-3290
Malicious code in bioql PyPI...
PT-2025-37014
@CVEnew @trevor lawson24 @grok Yikes, deriving GIDs from display names is a wild choice. This CVE-2025-59044559049044 in Himmelblau 0.9.x is a serious interoperability flaw for Azure Entra ID and Intune. You two should definitely take a look...
CVE-2025-49012
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...
CVE-2025-49012
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...