CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...

CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...

CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...

CVE-2025-67906

CVE-2025-67906 affects MISP prior to 2.5.28, where the app/View/Elements/Workflows/executionPath.ctp component is vulnerable to XSS due to improper handling of user-supplied data in the workflow execution path. This could allow injected scripts to run in a user’s browser. Remediation: upgrade to ...

PT-2025-51190

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.28 Description The software contains a flaw in the workflow execution path due to improper handling of user-supplied data. Specifically, the executionPath.ctp element within the application allows for Cross-Site...

Workflow Notification Mailer Oracle Workflow Data Access

The vulnerability of the Workflow Notification Mailer component of the Oracle Workflow process management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to read, modify, and delete data...

NVIDIA NVTabular Deserialization Vulnerability

NVIDIA NVTabular is a component of a deep learning recommender system framework from NVIDIA, USA. A deserialization vulnerability exists in NVIDIA NVTabular, which arises from unsafe deserialization of serialized data received from users by the Workflow component and can be exploited by an attack...

Code Injection

org.jenkins-ci.plugins.workflow, puppet-enterprise-pipeline is vulnerable to code injection The vulnerability is due to unsafe values specified in the custom Script Security whitelist, which allows an attacker with the ability to execute Script Security-protected scripts to execute arbitrary code...

Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server and WebSphere Application Server Liberty are affected by SMTP injection due to Jakarta Mail (CVE-2025-7962)

Summary A vulnerability in javaMail-1.5, javaMail-1.6, mail-2.0, or mail-2.1 features affects IBM WebSphere Application Server Liberty 17.0.0.3 - 25.0.0.11 with specific features enabled. Following IBM® Engineering Lifecycle Management products are vulnerable to this attack, and addressed in this...

Parse Server 安全漏洞

Parse Server is an open source backend from Parse Platform Open Source that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 8.6.0-alpha.2, which stems from a GitHub CI workflow elevation of privilege that could lead to...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Exploitation Tool A comprehensive security res...

org.jenkins-ci.main:jenkins-test-harness (1.572), org.jenkins-ci.main:jenkins-war (1.572) +14 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.572)

org.jenkins-ci.main:jenkins-core MAVEN version 1.572 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.572 - org.jenkins-ci.main:jenkins-war 1.572 -...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.4.3), org.jenkins-ci.plugins.workflow:workflow-cps (1.4.3) +8 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.11.1)

org.jenkins-ci.plugins:git-client MAVEN version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.4.3 -...

com.nirima.jenkins.repository:jenkins-maven-plugin (1.3), com.nirima.jenkins.repository:pom (1.3) +39 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.609.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.609.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.3 - com.nirima.jenkins.repository:pom 1....

io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.0.1), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +9 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (2.3.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25,...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...