GO-2025-3499 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods , short message alerts and product image zoom and other features . A security vulnerability exists in MyPrestaModules Prestashop Module version v6.2.9,...

PT-2022-20959 · Unknown · Newsletter Module

Name of the Vulnerable Software and Affected Versions: Newsletter Module versions 3.x Description: The issue is related to a SQL injection vulnerability. It can be exploited via the zemez newsletter email parameter at the "/index.php" API endpoint. Recommendations: For Newsletter Module version...

CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

Driver Disk for Qlogic netxtreme2 7.14.71.1 - For Citrix Hypervisor 8.x CR

Who Should Install this Driver Disk? Customers running a Citrix Hypervisor 8.x release who use Qlogic's netxtreme2 driver and wish to use the latest version of the following: Driver Module| Version ---|--- bnx2| 2.2.5z bnx2fc| 2.12.13 bnx2i| 2.11.25.0 bnx2x| 1.715.4.2 cnic| 2.5.21a Issues Resolve...

Code injection

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly...

Out-of-bounds

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...

PT-2009-3416 · Drupal · Protected Node

Name of the Vulnerable Software and Affected Versions: Protected Node module versions 5.x before 5.x-1.4 Protected Node module versions 6.x before 6.x-1.5 Description: The issue allows remote authenticated users with administer site configuration permissions to inject arbitrary web script or HTML...