CVE-2025-1391

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

Keycloak 访问控制错误漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a user-organization domain pattern mismatch in the organization function. An attacker exploiting this vulnerability could be...

CVE-2022-28693

CVE-2022-28693 is an information-disclosure vulnerability describing an unprotected alternative channel of return-branch target prediction on some Intel processors. The issue allows a locally authenticated user to potentially read sensitive memory. The primary context in the provided documents ti...

PT-2025-7053 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip affected versions not specified Description: A weekly cron job in Zulip demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization,...

CVE-2022-31631

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities...

CVE-2022-31631

CVE-2022-31631 affects PHP versions where PDO::quote() on SQLite can misquote long input, enabling potential SQL injection. Affected: PHP 8.0.x before 8.0.27, 8.1.x before 8.1.15, and 8.2.x before 8.2.2. The issue stems from incorrect quoting in the SQLite path, as documented in multiple advisori...

CVE-2020-3432

Cisco AnyConnect Secure Mobility Client for Mac OS contains a local-file corruption vulnerability in its uninstaller component caused by improper handling of directory paths. An authenticated, local attacker can exploit this by creating a symbolic link to a target file on a specific path, potenti...

CVE-2022-3180

The CVE-2022-3180 issue affects the WordPress WPGateway plugin (versions up to and including 3.5). The root cause is an unauthenticated privilege-escalation flaw that lets an attacker insert a malicious administrator account, enabling full site control as described across multiple sources. Exploi...

CVE-2022-3180

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

Cross-site Scripting (XSS)

Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...

CVE-2024-2878

Summary (CVE-2024-2878) : A DoS vulnerability in GitLab CE/EE affects all versions from 15.7 up to 16.9.7, 16.10 up to 16.10.5, and 16.11 up to 16.11.2. An attacker could cause service disruption by crafting unusual branch-name search terms. Impact: availability loss as described in the sources. ...

CVE-2024-3976

CVE-2024-3976 affects GitLab CE/EE, with an issue that allowed disclosure of the title and description of confidential issues from public projects to unauthorized users via the UI. Impacted versions are: 14.0–16.9.7, 16.10–16.10.5, and 16.11–16.11.2. The root cause is described as missing/incorre...

CVE-2024-3504

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in versi...

CVE-2024-1539

GitLab EE/CE vulnerability CVE-2024-1539 affects GitLab versions: 15.2 up to 16.9.7 (excluding 16.9.7), 16.10 up to 16.10.5 (excluding 16.10.5), and 16.11 up to 16.11.2 (excluding 16.11.2). The issue allows a banned group member to receive issue updates via the API. Root cause and explicit exploi...

CVE-2023-6386

GitLab CE/EE is affected by CVE-2023-6386. A denial-of-service arises from allocation of resources without limits/throttling, impacting all versions 15.11 up to but not including 16.6.7, 16.7 up to but not including 16.7.5, and 16.8 up to but not including 16.8.2. Remediation is to upgrade to fix...

CVE-2024-1902

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

How Imperva Infused AI Throughout Research and Development

The Age of AI Is Upon Us The current pace of technological change beggars’ belief. Generative Artificial Intelligence GenAI, released to the world a mere two years ago, promises to eliminate much of the tedium of the digital world. Software engineers around the world are already using it to speed...

CVE-2025-24966

reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the...

CVE-2023-0092

Affects Juju controller exposure: An authenticated user with read access to the Juju controller model can construct a remote request to download an arbitrary file from the controller filesystem. The issue is due to improper access control allowing file retrieval. Remediation: upgrade Juju to 2.9....