Slackware: Security Advisory (SSA:2025-036-03)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-39292

Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slac...

CVE-2022-35920

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue...

CVE-2024-51657

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

CVE-2024-6973

Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34...

CVE-2024-48445

creationtimestamp| type| source ---|---|--- 2025-02-04 22:16:39+00:00| seen| https://infosec.exchange/users/cve/statuses/113947928064913968 2025-02-04 23:15:47+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhf6s7p3jw2w 2025-02-05 02:23:49+00:00| seen|...

CVE-2024-56328 HTMLi(XSS without CSP) via Onebox urls in Discourse

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are...

CVE-2024-56328 HTMLi(XSS without CSP) via Onebox urls in Discourse

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are...

CVE-2025-20901

creationtimestamp| type| source ---|---|--- 2025-02-04 08:16:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhdmkuhcbf2c 2025-02-04 10:32:34+00:00| seen| https://t.me/cvedetector/17164 2025-02-04 12:19:11+00:00| seen|...

Security update for wget

This update for wget fixes the following issues: CVE-2024-10524: Drop support for shorthand URLs bsc1233773. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for you...

SUSE-SU-2025:20010-1 Security update for wget

This update for wget fixes the following issues: - CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. bsc1226419 - Update to GNU wget 1.24.5: Fix how subdomain matches are checked for HSTS. Wget will now also parse the srcset attribute in HTML tags Support reading...

CVE-2024-13347

The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2025-20639

creationtimestamp| type| source ---|---|--- 2025-02-03 04:16:28+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhaonzq52r2h 2025-02-03 07:46:49+00:00| seen| https://t.me/cvedetector/17048 2025-02-03 08:03:47+00:00| seen|...

Git LFS permits exfiltration of credentials via crafted HTTP URLs

...

Server-side Request Forgery (SSRF)

Overview django-icon-picker is an A custom Django model field that allows users to select icons from a predefined set. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the downloadandsavesvg function, which interpolates arbitrary URLs without filtering out...

CVE-2024-13651

creationtimestamp| type| source ---|---|--- 2025-02-01 04:16:03+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh3nph5r7z2p 2025-02-01 05:25:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3710 2025-02-01 07:16:25+00:00| seen|...

Fedora: Security Advisory (FEDORA-2025-c17ef0f176)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-12400

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Gi...

RHEL 8 : git-lfs (RHSA-2025:0825)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0825 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing th...