CVE-2025-22614

WeGIA is affected by a Stored Cross‑Site Scripting (XSS) in the dependente_editarInfoPessoal.php endpoint, specifically via the nome and SobrenomeForm parameters. The vulnerability arises from inadequate input validation/sanitization, allowing attackers to store malicious scripts on the server th...

PT-2025-4375 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A Reflected Cross-Site Scripting XSS vulnerability was identified in the "configuracao geral.php" endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

PT-2025-1632

Name of the Vulnerable Software and Affected Versions WebinarPress plugin for WordPress versions up to, and including, 1.33.24 Description The WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the sync-import-imgs function and missing...

PT-2025-3187 · Unknown · Simplecharm

Name of the Vulnerable Software and Affected Versions: SimpleCharm versions 1.4.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts into...

Mozilla Firefox Security Update (MFSA2024-39) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

PT-2025-21747

Name of the Vulnerable Software and Affected Versions: nbdkit versions prior to 1.42.3-1.1 Description: The issue impacts cloud storage, virtualization, and enterprise servers. Recommendations: For versions prior to 1.42.3-1.1, update to version 1.42.3-1.1 to resolve the issue...

PT-2025-53805

Name of the Vulnerable Software and Affected Versions qs versions prior to 6.14.1 Description A flaw exists in the qs parse modules library where the arrayLimit option does not properly enforce limits when using bracket notation in query strings, leading to a potential HTTP Denial of Service DoS...

PT-2024-17207 · Ctfd · Ctfd

Name of the Vulnerable Software and Affected Versions: CTFd versions prior to 3.7.5 Description: The issue concerns tokens used for account activation and password resetting in CTFd, which can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter...

PT-2024-34697 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.1.3 Description: The issue is related to an arithmetic overflow vulnerability in the retention period handling of ECS. An authenticated user with bucket or object-level access and the necessary privileges could...

Fedora 41 : libxml2 (2024-867a14de12)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-867a14de12 advisory. Update to 2.12.9 Fixes CVE-2024-40896. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Discourse 3.4.x < 3.4.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2024-36164 · Unknown · Seedprod Pro

Name of the Vulnerable Software and Affected Versions: SeedProd Pro versions prior to 6.18.11 Description: The issue is related to improper neutralization of special elements used in an SQL command, also known as SQL Injection. This allows for SQL Injection, potentially enabling unauthorized acce...

[SECURITY] Fedora 41 Update: subversion-1.14.5-1.fc41

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file...

Apple Safari Security Update (HT121846)

Apple Safari is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari"; ifdescription...

Apple MacOSX Security Update (HT121842)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-10370

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an integer underflow in the qtdemux parse trak function within qtdemux.c. This underflow can occur during the strf parsing case when the subtraction size -= 40 results in ...

PT-2024-9710 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: A DOM-based Cross-Site Scripting XSS issue affects Adobe Experience Manager, allowing an attacker to execute arbitrary code in the context of the victim's browser session. This...

openSUSE Security Advisory (openSUSE-SU-2024:0396-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-10373

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A null pointer dereference has been discovered in the id3v2 read synch uint function, located in id3v2.c. If id3v2 read synch uint is called with a null work-hdr.frame data, the pointer guint8 da...

Oracle Linux 8 : firefox (ELSA-2024-10752)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-10752 advisory. 128.5.1-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.5.1 - Add debranding patches Mustafa Gezen - Add OpenELA default...