Exploit for Code Injection in Xwiki

CVE-2025-24893-P...

CVE-2025-8771

creationtimestamp| type| source ---|---|--- 2025-08-09 07:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvxblsgiql2s...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of user-supplied URLs in the portal-settings-authentication-opensso-web component. An unauthenticated attacker can cause the server to initiate arbitrary HTTP requests to internal...

CVE-2025-4581

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the...

CVE-2025-4581

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the...

Linux Distros Unpatched Vulnerability : CVE-2024-6174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configuration...

Linux Distros Unpatched Vulnerability : CVE-2024-10462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4...

Linux Distros Unpatched Vulnerability : CVE-2020-12409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox 77...

CVE-2025-8749

creationtimestamp| type| source ---|---|--- 2025-08-08 14:06:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvvge56zrl2a...

Linux Distros Unpatched Vulnerability : CVE-2025-27152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even ...

CVE-2025-8535 cronoh NanoVault xrb URL main.js executeJavaScript cross site scripting

A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the file /main.js of the component xrb URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The...

Vvveb 访问控制错误漏洞

Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. An access control error vulnerability exists in Vvveb version 1.0.5 and earlier, which stems from incorrect manipulation of the parameter url leading to information disclosu...

BentoML 代码问题漏洞

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions 1.4.0 through 1.4.19 that stems from the file upload processing...

WordPress plugin Stop User Enumeration 安全漏洞

WordPress Stop User Enumeration plugin is a security plugin for WordPress, mainly used to detect and prevent hackers from scanning website usernames user enumeration attack to get the login name, which is the pre-detection behavior of brute force password cracking attack. A security vulnerability...

Island Lake WebBatch 安全漏洞

Island Lake WebBatch is a CGI scripting language and automation tool for the Windows platform from Island Lake, USA. A security vulnerability exists in versions of Island Lake WebBatch prior to 2025C that stems from a specially crafted URL could lead to remote code execution...

cloud-init: Cloud init permissions flaw

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...

The vulnerability of the pgAdmin 4 database management tool lies in the redirection of the URL to an unreliable website, allowing a hacker to redirect users to any given URL address.

The vulnerability of the pgAdmin 4 database management tool is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to an arbitrary URL address...

cloud-init: Cloud init permissions flaw

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...

cloud-init: Cloud init permissions flaw

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...

OESA-2025-1825 python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...