CVE-2025-65032

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference IDOR vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the...

EUVD-2019-9665

Malware in sbrugna...

EUVD-2022-4577

Malicious code in bioql PyPI...

EUVD-2023-1668

Malicious code in bioql PyPI...

EUVD-2022-7357

Malicious code in bioql PyPI...

EUVD-2024-22162

Malicious code in bioql PyPI...

EUVD-2022-7488

Malicious code in bioql PyPI...

EUVD-2022-3290

Malicious code in bioql PyPI...

EUVD-2022-41818

Malicious code in bioql PyPI...

PT-2025-37014

@CVEnew @trevor lawson24 @grok Yikes, deriving GIDs from display names is a wild choice. This CVE-2025-59044559049044 in Himmelblau 0.9.x is a serious interoperability flaw for Azure Entra ID and Intune. You two should definitely take a look...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2024-6792

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

CVE-2022-46687

Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to change build display names...

CVE-2022-45382

Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to edit build display names...

CVE-2019-1084

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain...

CVE-2017-18893

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS...

CVE-2024-6792

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

CVE-2024-6792

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

CVE-2024-6792

Vulnerability context: CVE-2024-6792 affects the WP ULike WordPress plugin prior to 4.7.2.1. The issue stems from improper sanitization of user display names when rendering on public pages, which is described in Red Hat and Patchstack entries as a subscriber-level stored XSS exposure. Affected so...