Private Data Structure Returned From A Public Method

github.com/apache/answer, is vulnerable to Private Data Structure Returned From A Public Method. The vulnerability is due to the application allowing external content to be loaded without restriction, allowing an attacker to track or identify users by collecting their IP addresses through...

SUSE CVE-2025-32026

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

XXE (XML External Entity Injection) in Jira Service Management Data Center and Server

This High severity XXE XML External Entity Injection vulnerability was introduced in version 5.12.0 of Jira Service Management Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 7.7, allows an attacker to access local and remote content. Atlassian...

PT-2025-15997 · Packagist · Ezsystems/Ezplatform-Richtext

Impact This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity XXE injection, which might be able to read files on the server. To exploit this...

PT-2025-15998 · Packagist · Ibexa/Fieldtype-Richtext

Impact This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity XXE injection, which might be able to read files on the server. To exploit this...

Moodle 4.4.x < 4.4.2 Multiples Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.4.x prior to 4.4.2. It is, therefore, affected by multiples vulnerabilities : - Matrix user/power level management not always working as expected with suspended users. - Lack of access control when using...

CVE-2025-32371 Unexpected external content may be displayed in DNN ImageHandler

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that t...

CVE-2025-32371 Unexpected external content may be displayed in DNN ImageHandler

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that t...

Malicious code in vite-plugin-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cffc6b2ef3ee7169eb637677097e46e1f9c980cd6fd606d1b521830c2a8cc92b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM: Information disclosure on IBM training service endpoint

The IBM training service endpoint had an information disclosure vulnerability that was reported to IBM, analyzed, and remediated. The vulnerability was discovered and reported by an external researcher...

Malicious code in wormhole-messenger-solana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3533c227d2e503f88e2ae202b9433a6a7a89000b952c2875242b1834dbd32089 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-29819

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...

CVE-2025-32026

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

CVE-2025-32026 Element Web could load a malicious instance of Element Call leaking media encryption keys

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

CVE-2025-32026

Element Web (Matrix Web client) versions 1.11.16–1.11.96 expose a vulnerability where, if configured to load Element Call from an external URL, an external page can gain access to media encryption keys used during a call. Root cause: external URL loading creates a trust boundary bypass that leaks...

CVE-2025-32026 Element Web could load a malicious instance of Element Call leaking media encryption keys

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

The vulnerability of the SAXBuilder tool for project management and information sharing in the JIRA system allows attackers to carry out XXE attacks.

The vulnerability of the SAXBuilder tool for project management and information sharing in the JIRA system is related to an error in restricting XML links to external objects. Exploiting this vulnerability could allow a malicious actor to carry out XXE attacks remotely...

Stable Channel Update for Desktop

The Stable channel has been updated to 135.0.7049.84/.85 for Windows, Mac and 135.0.7049.84 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept restrict...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is the United States of America Odo than Adobe company's set of rapid application development platform. Adobe ColdFusion suffers from a deserialization vulnerability, which occurs when the program lacks strict checksums when processing externally-entered serialized data. The...

Element 安全漏洞

Element is a Matrix web collaboration client from Element Open Source. A security vulnerability exists in Element versions 1.11.16 through 1.11.96, which stems from a configuration that allows an Element Call to be loaded from an external URL, resulting in the disclosure of media encryption keys...