CVE-2025-24180

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix...

CVE-2025-24180

The Safari browser and associated Apple operating systems (iOS , iPadOS , macOS Sequoia , visionOS , and watchOS ) are vulnerable to a flaw where a malicious website could claim WebAuthn credentials from another website sharing a registrable suffix. The root cause is identified as insufficient in...

CVE-2025-24180: URL Redirection to Untrusted Site

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix...

PT-2025-13880 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.4 visionOS versions prior to 2.4 iOS versions prior to 18.4 iPadOS versions prior to 18.4 macOS Sequoia versions prior to 15.4 Description: The issue was addressed with improved input validation. A malicious websit...

MAL-2025-2141 Malicious code in webauthn-codelab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1db4dcddcb204fd78a848e02724ef26a5bac5da98f78246a3a90084b790868b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webauthn-codelab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1db4dcddcb204fd78a848e02724ef26a5bac5da98f78246a3a90084b790868b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12225

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel through the default REST endpoints. An attacker can bypass authentication controls and potentially log in as an existing user without proper credentials by exploiting these...

io.quarkus:quarkus-security-webauthn-deployment (>=3.0.0.alpha1, <=3.17.8), io.quarkus:quarkus-test-security-webauthn (>=3.0.0.alpha1, <=3.17.8) potentially affected by CVE-2024-12225 via io.quarkus:quarkus-security-webauthn (>=3.0.0.alpha1, <=3.17.8)

io.quarkus:quarkus-security-webauthn MAVEN version =3.0.0.alpha1, =3.0.0.alpha1, =3.0.0.alpha1, =3.17.8 Source cves: CVE-2024-12225 Source advisory: SNYK:JAVA-IOQUARKUS-9376953...

gitea -- multiple vulnerabilities

Problem Description: Fix basic auth with webauthn Refactor internal routers partial backport, auth token const time comparing...

CentOS 7 : thunderbird (RHSA-2024:2913)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2913 advisory. - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability...

CVE-2024-47650

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through = 1.3.1...

CVE-2024-47650 WordPress WP-WebAuthn plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Axton WP-WebAuthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through 1.3.1...

CVE-2024-47650

CVE-2024-47650 : A stored XSS vulnerability exists in the WordPress WP-WebAuthn plugin up to version 1.3.1 due to improper input neutralization during web page generation. The issue affects WP-WebAuthn

CVE-2024-47650 WordPress WP-WebAuthn plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through = 1.3.1...

CVE-2024-47650: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through = 1.3.1...

PT-2024-32709 · WordPress · Wp-Webauthn

Name of the Vulnerable Software and Affected Versions: WP-WebAuthn versions 1.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS or Stored XSS. This allows for Stored XSS attacks. Recommendations...

WordPress plugin WP-WebAuthn has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress WP-WebAuthn Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-WebAuthn Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47650 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a5c171e8acd4 Credits theviper17 Required privilege Contributor...

PT-2024-6991

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 130.0.6723.58 Microsoft Edge affected versions not specified Description The issue is related to a use-after-free vulnerability in the WebAuthentication WebAuthn implementation, allowing a remote attacker to...