CVE-2024-51417

CVE-2024-51417 affects System.Linq.Dynamic.Core prior to 1.6.0. It allows remote access to properties on reflection types and static properties/fields. Affects versions before 1.6.0; remediation is to upgrade to version 1.6.0 or later. Connected sources confirm Red Hat, Veracode, GitHub advisorie...

CVE-2024-51417

An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields...

System.Linq.Dynamic.Core 安全漏洞

System.Linq.Dynamic.Core is a .NET Core/Standard port of the Microsoft assembly for .NET 4.0 Dynamic Language Features open-sourced by ZZZ Projects. A security vulnerability exists in System.Linq.Dynamic.Core version 1.4.6, which stems from a vulnerability that allows remote access to properties ...

PT-2025-2899 · Unknown · System.Linq.Dynamic.Core

Name of the Vulnerable Software and Affected Versions: System.Linq.Dynamic.Core versions prior to 1.6.0 Description: An issue in System.Linq.Dynamic.Core allows remote access to properties on reflection types and static properties/fields. Recommendations: For versions prior to 1.6.0, update to...

PT-2025-5252 · Unknown · Estatebud – Properties & Listings

Name of the Vulnerable Software and Affected Versions: Estatebud – Properties & Listings versions n/a through 5.5.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

WordPress plugin Estatebud – Properties & Listings 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability

CSRF to Settings Update & Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Estatebud – Properties & Listings versions = 5.5.0...

GO-2025-3394 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

Mattermost fails to properly validate post props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

GHSA-45V9-W9FH-33J6 Mattermost fails to properly validate post props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20086 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-21083 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps that stems from a failure to properly validate post props, which can be exploited by an attacker to cause the application to crash...

PT-2025-4189 · Mattermost · Mattermost Mobile Apps

Name of the Vulnerable Software and Affected Versions: Mattermost Mobile Apps versions =2.22.0 Description: The issue arises from the failure to properly validate post properties, allowing a malicious authenticated user to cause a crash via a malicious post. This can be exploited by an...

Keycloak 26.0.8 Multiple Vulnerabilities (26_0_8)

The version of Keycloak installed on the remote host is prior to 26.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 2608 advisory. - A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm...

CVE-2024-11736 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME or $PROPNAME. The serve...

CVE-2024-11736 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME or $PROPNAME. The serve...

CVE-2024-11736

CVE-2024-11736 (Keycloak) : The vulnerability arises when admins configure backchannel logout or admin URLs containing placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with environment variables/system properties during URL processing, potentially allowing a...

GHSA-F4V7-3MWW-9GC2 Keycloak allows unrestricted admin use of system and environment variables

A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME ...