CVE-2025-46657: Improper Neutralization of Input During Web Page Generation

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-1522

PostHog databaseschema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

OESA-2025-1453 raptor2 security update

Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fixes: In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in...

CVE-2023-37534

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...

CVE-2023-37534

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...

CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...

CVE-2023-37534

CVE-2023-37534 affects HCL Leap: insufficient URI protocol whitelist allows script injection via query parameters in the web app. Reported severity varies by source (NVD: CVSS v3.1 base 6.1; CNA data shows higher impact on integrity). Affected component is the HCL Leap URI handling logic; exploit...

CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...

PT-2025-17842

Name of the Vulnerable Software and Affected Versions HCL Leap affected versions not specified Description The issue is related to an insufficient URI protocol whitelist, which allows script injection through query parameters. Recommendations At the moment, there is no information about a newer...

CVE-2025-1521

PostHog slackincomingwebhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists with...

CVE-2025-1522 PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability

PostHog databaseschema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-1521 PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability

PostHog slackincomingwebhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists with...

Moderate: ruby:3.1 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: rexml: DoS vulnerability in REXML CVE-2024-39908 rexml: rubygem-rexml: DoS when parsing an XML having many specific characters suc...

ALSA-2025:4063 Moderate: ruby:3.1 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: rexml: DoS vulnerability in REXML CVE-2024-39908 rexml: rubygem-rexml: DoS when parsing an XML having many specific characters suc...

CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

[SECURITY] [DLA 4133-1] wget security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4133-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk April 21, 2025 https://wiki.debian.org/LTS -...

CVE-2025-43916

CVE-2025-43916 affects Sonos api.sonos.com (endpoint /login/v3/oauth). The flaw allows a redirect_uri containing userinfo in the authority component, violating RFC 6819 5.2.3.5 and potentially causing an authorization code to be sent to an attacker-controlled destination. Public-fix details are n...

PT-2025-17434 · Sonos · Sonos

Name of the Vulnerable Software and Affected Versions: Sonos versions through 2025-04-21 Description: The issue concerns the /login/v3/oauth endpoint, which accepts a redirect uri containing userinfo in the authority component. This is inconsistent with RFC 6819 section 5.2.3.5, potentially...

Azure Linux 3.0 Security Update: ruby (CVE-2025-27221)

The version of ruby installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27221 advisory. - In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent...

USN-7442-1: Ruby vulnerabilities

It was discovered that the Ruby CGI gem incorrectly handled parsing certain cookies. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. CVE-2025-27219 It was discovered that the Ruby CGI gem incorrectly handled parsing certain regular expressions...