Sunshine 安全漏洞

Sunshine is an open source self-service game streaming host for Moonlight by LizardByte. A security vulnerability exists in versions prior to Sunshine 2025.628.4510, which stems from a lack of clickjacking protection in the web UI and could lead to unauthorized actions...

CERTFR-2025-ACT-027

creationtimestamp| type| source ---|---|--- 2025-06-30 12:15:34+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lst5y37vvg26 2025-06-30 12:15:35+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114772261835133895...

CVE-2025-36027

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against...

CVE-2025-36027

CVE-2025-36027 affects IBM Datacap 9.1.7–9.1.9. Description and Red Hat/IBM bulletin confirm a clickjacking issue where a remote attacker could exploit a malicious site to hijack the victim’s click actions (CWE-1021). Impact is UI interaction manipulation with potential for follow-on attacks; CVS...

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data...

PT-2025-27179 · Unknown · Opicron Image Cleanup

Name of the Vulnerable Software and Affected Versions: opicron Image Cleanup versions 1.9.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the opicron Image Cleanup, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For opicron Image...

PT-2025-27180 · Unknown · Slickstream

Name of the Vulnerable Software and Affected Versions: Slickstream versions n/a through 2.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks ...

PT-2025-27161 · Cyrlitera · Cyrlitera

Name of the Vulnerable Software and Affected Versions: Cyrlitera versions 1.2.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 1.2.0 and earlier, update to a...

Car Rental Portal Cross-Site Request Forgery Vulnerability

Car Rental Portal is a rental car portal. Car Rental Portal suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. The vulnerability can be exploited by an attacker to spoof a...

PT-2025-27157 · Edgarrojas · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: EDGARROJAS WooCommerce PDF Invoice Builder versions 1.2.148 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed. This can lead to Cross Site Request Forgery. Recommendations: For versio...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

PT-2025-27152 · Unknown · Burst Statistics

Name of the Vulnerable Software and Affected Versions: Burst Statistics versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

CVE-2025-52991

CVE-2025-52991 affects Nix before 2.24.15, 2.26.4, 2.28.4, 2.29.1; Lix before 2.91.2, 2.92.2, 2.93.1; and Guix before 1.4.0-38.0e79d5b. The root cause is that temporary build directories are created in world-readable and world-writable locations, allowing local users to deceive the package manage...

📄 Mouselink 5.0.1 Unauthenticated Remote System Control

Mouselink version 5.0.1 is vulnerable to JWT authentication bypass, allowing remote attackers to perform system-level actions such as shutdown, restart, sleep, and logout without valid credentials. Exploit Title: Mouselink 5.0.1 - Unauthenticated Remote System Control Date: 26/06/25 Exploit Autho...

PT-2025-27174 · Unknown · Hide Admin Bar From Front End

Name of the Vulnerable Software and Affected Versions: Hide Admin Bar From Front End versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a...

AZL-64337 CVE-2024-11584 affecting package cloud-init for versions less than 24.3.1-2

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...

Hewlett Packard Enterprise OneView for VMware vCenter 安全漏洞

Hewlett Packard Enterprise OneView for VMware vCenter is a VMware vCenter server management software plug-in for managing HPE ProLiant servers and storage systems from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise OneView for VMware vCenter, which...

PT-2025-26959 · Unknown · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.13 Open Social versions 12.4.0 through 12.4.12 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue ca...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...