Unauthenticated DOM Based XSS in YesWiki

Unauthenticated DOM Based XSS in YesWiki ' . "\n"; if $nbtotal 1 $output .= t'TAGSTOTALNBPAGES', 'nbtotal' = $nbtotal; elseif $nbtotal == 1 $output .= t'TAGSONEPAGEFOUND'; else $output .= t'TAGSNOPAGE'; $output .= !empty$tabselectedtags ? ' ' . t'TAGSWITHKEYWORD' . ' ' . implode' '...

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution...

CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/logentries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana...

CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/logentries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana...

PT-2025-6342

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, which could lead to a security feature bypass. An...

PT-2025-1552 · Lexmark · Lexmark Devices

Name of the Vulnerable Software and Affected Versions: Lexmark devices affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability has been identified in the Web Services feature of newer Lexmark devices. This issue allows an attacker to forge requests to interna...

PT-2025-6045

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43 Description A memory leak issue was found in the link order scan function of the ld component, specifically in the file ld/ldelfgen.c. This issue can be exploited remotely, but the complexity of an attack is rather...

XSS when checking tables

PMASA-2025-1 Announcement-ID: PMASA-2025-1 Date: 2025-01-20 Updated: 2025-01-23 Summary XSS when checking tables Description An XSS vulnerability has been discovered with the phpMyAdmin "Check tables" feature. A specially–crafted table or database name could be used to trigger an XSS attack...

PT-2025-1233

Name of the Vulnerable Software and Affected Versions SpagoBI version 3.5.1 Description The issue is related to the script input feature of SpagoBI, which allows arbitrary code execution. This is due to the lack of measures to neutralize special elements used in the command input field...

GHSA-V4MQ-X674-FF73 AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

CVE-2025-23206

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

CVE-2025-23206

The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

Microsoft Windows HTML Platforms Security Feature Bypass Vulnerability

Microsoft Windows HTML Platforms is a technology for rendering and executing HTML content on the Windows operating system. A security feature bypass vulnerability exists in Microsoft Windows HTML Platforms, which is caused by a security feature bypass vulnerability in the HTML Platforms component...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.6.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-23366 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.6.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =35.0.0.beta1 Source cves: CVE-2025-23366 Source advisory: OSV:GHSA-JHVJ-F397-8W6Q...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.6.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-23366 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.6.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =35.0.0.beta1 Source cves: CVE-2025-23366 Source advisory: GHSA-JHVJ-F397-8W6Q...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Jan 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update January 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...