2323 matches found
CVE-2025-27388
CVE-2025-27388 describes an issue where loading arbitrary external URLs through WebView components can inject malicious JavaScript to steal user tokens. The initial entry notes high impact (CVSS 4.0 base score 8.3) with NETWORK attack vector and high confidentiality impact. Connected documents co...
CVE-2025-5941
creationtimestamp| type| source ---|---|--- 2025-08-14 07:09:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwdruk3hxp2g...
Authentication Bypass
github.com/oauth2-proxy/oauth2-proxy is vulnerable to Authentication Bypass. The vulnerability is due to the skipauthroutes configuration option matching against the full request URI, including query parameters, when using overly permissive regex patterns, which allows an attacker to craft URLs...
CVE-2025-42942
SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could...
CVE-2025-32451
creationtimestamp| type| source ---|---|--- 2025-08-13 14:00:08+00:00| seen| https://infosec.place/objects/7dd393e0-0d8c-47ac-b972-1b74cdd00736 2025-08-13 17:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwcdcj2uol2d...
CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure
Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...
CVE-2025-8881
creationtimestamp| type| source ---|---|--- 2025-08-13 05:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwb56sfqn62c 2025-08-16 06:33:05+00:00| seen| https://bsky.app/profile/secqube.com/post/3lwiqqvm4q22m...
CVE-2025-4410
creationtimestamp| type| source ---|---|--- 2025-08-13 05:49:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwb4vtqwsi2s...
CVE-2025-537408
creationtimestamp| type| source ---|---|--- 2025-08-13 05:23:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0250...
Cherry Studio 操作系统命令注入漏洞
Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An operating system command injection vulnerability exists in Cherry Studio version 1.5.1, which stems from a streamableHttp MCP server connection that does not properly clean up the URL, which could lead to...
GHSA-22WQ-Q86M-83FH
creationtimestamp| type| source ---|---|--- 2025-08-12 16:52:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115016829455362878...
CVE-2025-42934
creationtimestamp| type| source ---|---|--- 2025-08-12 02:43:09+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115013490316314202...
CVE-2025-42936
creationtimestamp| type| source ---|---|--- 2025-08-12 02:43:09+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115013490316314202...
CVE-2025-42942 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP
SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
CVE-2025-8844
creationtimestamp| type| source ---|---|--- 2025-08-11 16:01:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw5674hisi2e...
BIT-LIBPHP-2024-5458 Filter bypass in filter_var (FILTER_VALIDATE_URL)
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as filtervar when validating URLs FILTERVALIDATEURL for certain types of URLs the function will result in invalid user information username + password part of URLs being...
BIT-LIBPHP-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong dat...
BIT-LIBPHP-2020-7066 get_headers() silently truncates after a null byte
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using getheaders with user-supplied URL, if the URL contains zero \0 character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheade...