BIT-GITLAB-2024-12093 Improper Validation of Consistency within Input in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions...

libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

CVE-2025-5172

A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the publi...

CVE-2025-5172

CVE-2025-5172 affects Econtrata up to 20250516. The vulnerability resides in an unknown function within /valida, where manipulating the usuario parameter yields SQL injection. Exploitation is described as remote and publicly disclosed, with vendor non-response noted. Connected sources corroborate...

CVE-2025-5170

The CVE-2025-5170 issue affects llisoft MTA Maita Training System version 4.5, specifically the AdminShitiListRequestVo function in com\llisoft\controller\admin\shiti\AdminShitiController.java. The vulnerability arises from improper handling of the stTypeIds argument, enabling SQL injection that ...

CVE-2025-5161 H3C SecCenter SMP-E1114P02 download operationDailyOut path traversal

A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDailyOut of the file /safeEvent/download. The manipulation of the argument filename leads to path traversal. The attack can be launched remotel...

CVE-2025-5160 H3C SecCenter SMP-E1114P02 download path traversal

A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The...

PT-2025-22900 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: A missing authorization vulnerability in TCMAN's GIM allows an authenticated attacker to access any functionality of the application, even when they are not available through the user interface. To exploit...

CVE-2025-5157 H3C SecCenter SMP-E1114P02 fileContent path traversal

A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been classified as critical. This affects the function fileContent of the file /cfgFile/fileContent. The manipulation of the argument filePath leads to path traversal. It is possible to initiate the attack remotely. Th...

CVE-2025-5106

A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the file /app/fax/faxview.php of the component Filename Handler. The manipulation of the argument faxfile leads to os command injection. It is possible to initiate the attack...

CVE-2025-5139

A vulnerability was found in Qualitor 8.20/8.24. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php of the component Office 365-type Connection Handler. The manipulation of the argument...

CVE-2025-5138 Bitwarden PDF File cross site scripting

A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2025-5135

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site...

CVE-2025-5135

CVE-2025-5135 affects Tmall Demo up to 20250505. The vulnerability is an XSS in the Product Details Page, triggered by manipulating the Product Name/Product Title in the file path /tmall/admin/. The issue concerns some unknown functionality of that admin path and is exploitable remotely; the expl...

CVE-2025-5135 Tmall Demo Product Details Page admin cross site scripting

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site...

CVE-2025-5133

CVE-2025-5133 concerns Tmall Demo up to 20250505, affecting the Search Box component. The vulnerability is a cross-site scripting (XSS) issue caused by a misbehavior of an unknown function in the Search Box, enabling remote exploitation. The exploit has been publicly disclosed; no affected versio...

CVE-2025-5131

A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the file tmall/admin/uploadCategoryImage. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated...

CVE-2024-12093

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions...

CVE-2025-5126

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. Performing manipulation of the argument year/month/day/hour/minute results in command injection. The attack may be...

CVE-2025-5114

The CVE-2025-5114 entry affects easysoft zentaopms 21.5_20250307. According to PT-2025-22798 (and corroborating entries), the vulnerability resides in the Edit function of the Committer component, specifically the endpoint /index.php?m=editor&f=edit&filePath=…&action=edit, where manipulating the ...