CVE-2025-52931 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body...

BIT-LIBPHP-2021-21706 ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...

BIT-LIBPHP-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

CVE-2024-55402

4C Strategies Exonaut before v22.4 was discovered to contain an access control issue...

Astro 输入验证错误漏洞

Astro is an Astro open source web framework for content-driven websites. An input validation error vulnerability exists in Astro versions 5.2.0 through 5.12.7, which stems from improper handling of double-slash paths and could lead to an open redirection attack...

CVE-2025-54124

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16. A patched version of the package is available...

PT-2025-32261 · 4C Strategies · Exonaut

Name of the Vulnerable Software and Affected Versions: 4C Strategies Exonaut versions prior to 22.4 Description: An issue allows attackers to execute a directory traversal. Recommendations: Update to version 22.4 or later...

PT-2025-32283 · Imanami +1 · Groupid +1

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions 11.0.0.0 through 11.1.25161.02 Description: Netwrix Directory Manager formerly Imanami GroupID inserts sensitive information into data sent to authenticated users. Recommendations: Update to version...

CVE-2025-50754

Unisite CMS version 5.0 contains a stored Cross-Site Scripting XSS vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the...

NVIDIA Omniverse Launcher < 1.9.19 Information Disclosure

The version of NVIDIA Omniverse Launcher installed on the remote host is prior to 1.9.19. It is, therefore, affected by a vulnerability. NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to t...

CVE-2025-5061 WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

RUCKUS SmartZone 安全漏洞

RUCKUS SmartZone is a network controller from RUCKUS. A security vulnerability exists in versions prior to RUCKUS SmartZone 6.1.2p3 Refresh Build that stems from an authentication bypass that could lead to a security risk...

Amazon Linux 2 : ruby (ALAS-2025-2957)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2957 advisory. The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a...

CVE-2025-54386

Traefik vulnerability CVE-2025-54386: a path traversal flaw in WASM Traefik’s plugin installation enables overwriting arbitrary files outside the plugin directory via crafted ZIP archives containing "../" sequences. Affected versions: 2.11.27 and earlier; 3.0.0–3.4.4; 3.5.0-rc1. Impact includes r...

CVE-2012-10022 Kloxo <= 6.1.12 Local Privilege Escalation

Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attacker...

CVE-2012-10022

CVE-2012-10022 affects Kloxo 6.1.12 and earlier. It involves two setuid root binaries, lxsuexec and lxrestart; lxsuexec performs a uid check and allows execution of commands as root when the invoking user has uid 48, enabling local privilege escalation from a user with Apache-level access without...

PT-2025-31705

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.27 and below Traefik versions 3.0.0 through 3.4.4 Traefik version 3.5.0-rc1 Description Traefik is an HTTP reverse proxy and load balancer. A path traversal vulnerability exists in the WASM Traefik’s plugin installation...

Docker Engine 28.2 < 28.3.3 Local Docker Ports Exposed to Network

The version of the Docker Engine Moby installed on the remote host is between 28.2.0 to 28.3.2 It is therefore affected by an vulnerability that exposes local ports to the network. When the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker...

VulnCheck KEV: CVE-2020-8194

Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download...