Linux Distros Unpatched Vulnerability : CVE-2021-39878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary...

CVE-2025-58067 Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI

Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceedto" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library ...

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

Impact A vulnerability has been identified when using Fleet to manage Helm charts where sensitive information is passed through BundleDeployment.Spec.Options.Helm.Values may be stored in plain text. This can result in: 1. Unauthorized disclosure of sensitive data: Any user with GET or LIST...

Malicious code in @ibm-integration/flow-canvas (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41914 Malicious code in @ibm-integration/flow-canvas (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in petstore-integration-test (npm)

The package petstore-integration-test was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96991c4e15df35927756d154bf8d985ad4d42eb85514c35adb2a0cc2bdc7218e This package installs a dependency hosted on a custom domain th...

MAL-2025-42055 Malicious code in petstore-integration-test (npm)

The package petstore-integration-test was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96991c4e15df35927756d154bf8d985ad4d42eb85514c35adb2a0cc2bdc7218e This package installs a dependency hosted on a custom domain th...

CVE-2025-55750 Gitpod Classic Affected by Bitbucket OAuth Token Exposure via Redirect Fragment

Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase (CVE-2025-33142, CVE-2025-48976)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

gitpod 安全漏洞

gitpod is a cloud-based integrated development environment open-sourced by gitpod. A security vulnerability exists in versions prior to gitpod main-gha.33628, which stems from mishandling of the Bitbucket OAuth integration, which could lead to access token disclosure...

Contrast leaks workload secrets to logs on INFO level

This is the same vulnerability as https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8. The original vulnerability had been fixed for release v1.8.1, but the fix was not ported to the main branch and thus not present in releases v1.9.0 ff. Below is a brief repetition of...

CVE-2025-48347

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bxslider-integration allows Stored XSS.This issue affects bxSlider integration for WordPress: from n/a through = 1.7.2...

CVE-2025-48347 WordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bxslider-integration allows Stored XSS.This issue affects bxSlider integration for WordPress: from n/a through = 1.7.2...

CVE-2025-48347

CVE-2025-48347 denotes a Stored XSS in the bxSlider integration for WordPress plugin (versions up to 1.7.2). Root cause: improper neutralization of input during web page generation. Impact: stored XSS in WordPress pages rendered via the plugin. Affected software: bxSlider integration for WordPres...

CVE-2025-48347 WordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress allows Stored XSS. This issue affects bxSlider integration for WordPress: from n/a through 1.7.2...

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentraladminlogin2faverify function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identic...

PT-2025-35016

Name of the Vulnerable Software and Affected Versions: bxSlider integration for WordPress versions through 1.7.2 Description: The Vincent Mimoun-Prat bxSlider integration for WordPress contains a Stored Cross-Site Scripting XSS issue. The flaw resides in improper neutralization of input during we...

WordPress plugin bxSlider integration for WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2025-2246 Missing Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API...

CVE-2025-2246

Technical details about CVE-2025-2246 are not publicly provided in the connected documents; no confirmed affected products, versions, or fixes are documented here. Monitor for updates.