CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager

Git Credential Manager GCM is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git's documentation restricts the...

CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager

Git Credential Manager GCM is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git's documentation restricts the...

EulerOS 2.0 SP9 : ruby (EulerOS-SA-2025-1063)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have sam...

CVE-2025-23038

CVE-2025-23038 affects the WeGIA open source web manager. A stored XSS exists in the remuneracao.php endpoint via the descricao parameter due to insufficient input validation/sanitization. Malicious scripts are stored on the server and executed when the affected page is loaded. The issue has been...

CVE-2025-23038 Cross-Site Scripting (XSS) Stored endpoint 'remuneracao.php ' parameter 'descricao' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the remuneracao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into th...

CVE-2025-23031

CVE-2025-23031 is a stored-XSS in WeGIA’s adicionar_alergia.php endpoint, affecting the nome parameter. The vulnerability arises from insufficient input validation/sanitization, allowing malicious scripts to be stored on the server and executed when the affected page is loaded by users. Impact: a...

CVE-2025-23032

Summary (CVE-2025-23032, WeGIA) : A Stored Cross-Site Scripting (XSS) vulnerability exists in the WeGIA application at the adicionar_escala.php endpoint, where input in the escala parameter is not properly validated or sanitized. The embedded payload is stored on the server and executed in users’...

CVE-2025-23035 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_tipo_quadro_horario.php' parameter 'tipo' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionartipoquadrohorario.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious...

CVE-2025-23036

The CVE-2025-23036 entry concerns the WeGIA open‑source web manager. A Reflected Cross‑Site Scripting (XSS) vulnerability exists in the pre_cadastro_funcionario.php endpoint, allowing an attacker to inject malicious scripts via the msg_e parameter. The root cause is a lack of validation/sanitizat...

CVE-2025-23037

CVE-2025-23037 concerns WeGIA, an open-source web manager. The vulnerability is a Stored Cross-Site Scripting (XSS) in the control.php endpoint, where user input in the cargo parameter is not properly validated, allowing a payload to be stored on the server and executed when the affected page is ...

CVE-2025-23037 Cross-Site Scripting (XSS) Stored endpoint 'control.php' parameter 'cargo' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the...

CVE-2024-56138

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificates used to...

CVE-2024-51491

CVE-2024-51491 affects notation-go (CRL revocation cache). The root cause is CRL cache updates via os.Rename: when source and destination reside on different mount points, the operation can fail with EXDEV, causing a crash of notation and aborting signature verification. Affected component is crl...

CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab's security audit on the Certificate Revocation List CRL based revocation check feature. After retrieving the CRL, notation-go...

CVE-2024-56138 Timestamp signature generation lacks certificate revocation check in notion-go

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificates used to...

CVE-2025-22617

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the editarsocio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in t...

CVE-2025-22614

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the dependenteeditarInfoPessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious...

CVE-2025-22613

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the informacaoadicional.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts...

CVE-2025-22613

The CVE-2025-22613 entry describes a stored XSS in WeGIA’s informacao_adicional.php endpoint, where the descricao parameter accepts unsanitized input and stores the script on the server. The payload is executed in users’ browsers when the affected page is loaded. Affected software is WeGIA before...

CVE-2025-22614 WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente_editarInfoPessoal.php ' parameters 'nome' 'SobrenomeForm'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the dependenteeditarInfoPessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious...