32813 matches found
CVE-2025-12167
The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...
CVE-2025-12167 Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset
The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...
CVE-2025-12167 Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset
The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...
CVE-2025-12167
CVE-2025-12167 affects the WordPress plugin “Contact Form 7 AWeber Extension” (versions through 0.1.42). The root cause is a missing capability check on the AJAX endpoint named wp_ajax_aweber_logreset, allowing authenticated users with Subscriber-level access and above to modify data by resetting...
OESA-2025-2630 tomcat security update
The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...
Red Database TracePluginImpl Log Record Trig
The vulnerability of the TracePluginImpl::logRecordTrig function in the TracePluginImpl.cpp module of the “Red Database” database management system is related to the loss of important security-relevant information. Exploiting this vulnerability could allow an attacker to conceal their actions...
CVE-2025-64326
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
PYSEC-2025-126
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
PYSEC-2025-230
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
CVE-2025-64326
Weblate (web-based localization tool) versions 5.14 and earlier leak the inviting user’s IP address in the audit log, which can be viewed by invited project members. The root cause is exposure of IPs in admin-triggered actions within the audit log. The issue is fixed in Weblate 5.14.1. Affected p...
EUVD-2025-37937
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
CVE-2025-64326 Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
CVE-2025-12486
CVE-2025-12486 covers a cross-site scripting/remote code execution vulnerability in Heimdall Data Database Proxy. The flaw arises from improper validation of user-supplied data in the handling of database event logs, enabling arbitrary script injection and allowing an attacker to execute code in ...
BIT-TOMCAT-2025-55754 Apache Tomcat: console manipulation via escape sequences in log messages
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an...
galera and mariadb security update
An update is available for galera. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Galera is a fast synchronous multimaster wsrep provider replication engine for...
Revive Adserver: Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval
Description: The setPerPage query parameter controls pagination for the log viewer but is not validated or capped on the server. An attacker can supply an extremely large numeric value for example setPerPage=100000000000000000 and the application will attempt to honor that value when building the...
CVE-2025-64326: Improper Removal of Sensitive Information Before Storage or Transfer
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990492)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990492 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it ...
Heimdall Data Database Proxy Cross-Site Script Vulnerability
Heimdall Data Database Proxy is an intelligent database proxy from Heimdall Data, Inc. A cross-site scripting vulnerability exists in Heimdall Data Database Proxy that stems from a lack of validation of user-supplied data in database event log processing, which could lead to arbitrary script...