The vulnerability of the Briefcase Module component in the Zimbra Collaboration Suite email management system allows a attacker to perform XSS attacks.

The vulnerability of the Briefcase Module component in the Zimbra Collaboration Suite email management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the Open Social CMS system’s Drupal module, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Open Social CMS system, Drupal, is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-40672

In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40672

CVE-2024-40672 affects Android’s ChooserActivity.java, where a missing permission check in onCreate could bypass factory reset protections. This enables local elevation of privilege with no extra execution privileges or user interaction required. Documented impact is a local EoP; exploitation det...

BIT-RUBY-MIN-2021-32066

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between th...

The vulnerability of the Compositing component in Google Chrome and Microsoft Edge browsers allows attackers to replace the user interface.

The vulnerability of the Compositing component in Google Chrome and Microsoft Edge exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-820)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-820 advisory. 2025-02-12: CVE-2024-11079 was removed from this advisory. 2025-02-12: The severity of this advisory has been changed from medium to low. Tenable has extracted the preceding description block directly...

PT-2025-1613

Name of the Vulnerable Software and Affected Versions Arm Cortex-A72 versions prior to r1p0 Arm Cortex-A73 affected versions not specified Arm Cortex-A75 affected versions not specified Description The issue may allow an adversary to gain a weak form of control over the victim's branch history...

The vulnerability of the web interface of the IBM Sterling B2B Integrator software allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the web interface of the IBM Sterling B2B Integrator software solution relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code and gain unauthorized access to protected...

The vulnerability of the web interface of the IBM Sterling B2B Integrator software allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the web interface of the IBM Sterling B2B Integrator software solution relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain unauthorized access to protected...

CLSA-2025-1737156361 git: Fix of CVE-2024-32465

CVE-2024-32465: Fix issue allowing protections to be bypassed when obtaining Git repository from untrusted sources...

macOS 13.x < 13.6.7 Multiple Vulnerabilities (120900)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.6.7. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.6.7, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and...

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to the lack of measures taken to protect the website structure, allows a malicious actor to carry out XSS attacks.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

The vulnerability of Websoft HCM’s automation software for HR processes allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Security Advisory - Ivanti Application Control Engine (CVE-2024-10630)

Summary Ivanti has released updates for Ivanti Application Control Engine which address a high severity vulnerability. Successful exploitation could lead to bypassing configured protections. We are not aware of any customers being exploited by this vulnerability at the time of disclosure...

PT-2025-4220 · Microsoft · Windows Virtualization-Based Security +1

Name of the Vulnerable Software and Affected Versions: Windows Virtualization-Based Security VBS affected versions not specified Description: A security-feature bypass issue allows attackers to affect the system. This issue is related to the Windows Virtualization-Based Security VBS and enables...

The vulnerability in the web server of Cisco Adaptive Security Appliance (ASA), a microprogramming-based network device, allows attackers to execute XSS attacks.

The vulnerability of Cisco Adaptive Security Appliance ASA’s microprogramming-based web server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Hello DCO, Goodbye CLA: Simplifying Contributions to Spring

The Spring team will be rolling out a simplified contribution process that replaces the requirement to sign a Contributor License Agreement CLA with a Developer Certificate of Origin DCO. The process will start this week with Spring Framework, Spring Security, & Spring Boot and then roll out to t...

PT-2025-1200 · Moxa · Edr-G9010 +9

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 versions prior to the fixed version Moxa EDR-8010 versions prior to the fixed version Moxa EDR-G902 versions prior to the fixed version Moxa EDR-G903 versions prior to the fixed version Moxa EDR-G9004 versions prior to the fixed...

GHSA-G2VG-8HFG-79VJ Koji Cross-site Scripting

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code...