OXID eShop 安全漏洞

OXID eShop is a suite of online e-commerce platforms from OXID Germany. A security vulnerability exists in versions prior to OXID eShop 7, which stems from a CMS page combined with Smarty that may display user information...

CVE-2024-56526

An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...

CVE-2024-56526

CVE-2024-56526 affects OXID eShop prior to version 7. A CMS page that uses Smarty may display user information if the CMS page contains a Smarty syntax error, leading to information exposure. The issue is documented across multiple connected feeds (Red Hat, GHSA, Snyk, PT Security, CNNVD, etc.). ...

CVE-2024-56526

An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...

PT-2025-20917

Name of the Vulnerable Software and Affected Versions: OXID eShop versions prior to 7 Description: An issue in OXID eShop allows CMS pages, when used in combination with Smarty, to potentially display user information if a CMS page contains a Smarty syntax error. Recommendations: For versions pri...

CVE-2025-31209

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information...

CVE-2025-31209

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to disclosure of user information...

CVE-2025-31209

The CVE-2025-31209 issue is an out-of-bounds read that could lead to disclosure of user information during file parsing. Affected products include watchOS 11.5; macOS Sonoma 14.7.6; tvOS 18.5; iPadOS 17.7.7; iOS 18.5 and iPadOS 18.5; macOS Sequoia 15.5; visionOS 2.5; macOS Ventura 13.7.6. Mitigat...

CVE-2025-31209

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information...

PT-2025-23033 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 137.0.7151.55 Description: The issue is related to an inappropriate implementation in BFCache, allowing a remote attacker to potentially obtain user information via a crafted HTML page. Recommendations: For...

PT-2025-20761 · Apple · Ipados +8

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions...

Apple多款产品 安全漏洞

Apple iOS is an operating system for mobile devices, Apple watchOS is an operating system for smartwatches, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in a number of Apple products that stems from insufficient boundary checks and may result in the...

CVE-2025-46345

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue...

PT-2025-18668 · Gotenna · Gotenna

Name of the Vulnerable Software and Affected Versions: goTenna v1 devices with app 5.5.3 and firmware 0.25.5 Description: An issue was discovered where the GID, which is the user's phone number by default unless they opt out, is not encrypted in messages. This is sensitive information as it can b...

CVE-2025-24887

OpenCTI has a CVE-2025-24887 vulnerability affecting versions 6.4.8–6.4.9. The issue lets a user bypass the allow/deny lists to modify attributes meant to be immutable, including toggling the external flag, changing a user’s own token, and editing non-allow-listed attributes such as otp_qr and ot...

CVE-2025-46552 KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation

KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses...

CVE-2025-46552 KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation

KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses...

CVE-2025-24270

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to leak sensitive user information...

CVE-2025-3625 Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication 2FA...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to improper enforcement of the 'Allow users to view/update archived channels' system setting, which allows authenticated users to access member information in archived channels even when the...