PT-2025-11328

Name of the Vulnerable Software and Affected Versions tj-actions/changed-files versions prior to 46.0.1 Description A supply chain attack targeted the tj-actions/changed-files GitHub Action, affecting over 23,000 repositories. A threat actor compromised a bot account's personal access token to...

The vulnerability of Zoom’s video conferencing software, related to improper handling of user actions, allows attackers to disclose sensitive information.

The vulnerability of Zoom video conferencing software is related to improper handling of user actions. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

AZL-58511 CVE-2025-21857 affecting package kernel for versions less than 6.6.82.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...

Malicious code in actions-project-version-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dfacd7dc56f2f0ae2b911d6bd9b2b8d50e4273f1f28a014bf64dfa9fdb9ff3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27915

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A stored cross-site scripting XSS vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its...

PT-2025-11694

Name of the Vulnerable Software and Affected Versions reviewdog/action-setup version 1 Description The GitHub Action reviewdog/action-setup was compromised between March 11, 2025, 18:42 and 20:31 UTC with malicious code. This code dumps exposed secrets to GitHub Actions Workflow Logs. Actions tha...

CVE-2025-27915

The CVE-2025-27915 issue affects Zimbra Collaboration (ZCS) Classic Web Client, where insufficient sanitization of HTML in ICS files enables stored XSS when viewing an email with a crafted ICS entry. The underlying flaw allows embedded JavaScript to execute via an ontoggle event inside a tag, en...

CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4...

UBUNTU-CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4...

CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Fileupload and Apache Tomcat

Summary Vulnerabilities have been identified in Apache Commons Fileupload and Apache Tomcat which are used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2016-3092 DESCRIPTIO...

CVE-2023-48790

A cross site request forgery vulnerability CWE-352 in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests...

CVE-2023-48790

A cross site request forgery vulnerability CWE-352 in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests...

CVE-2023-48790

A cross site request forgery vulnerability CWE-352 in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests...

CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-25748

CVE-2025-25748 describes a CSRF vulnerability in HotelDruid 3.0.7, specifically in the gestione_utenti.php endpoint. The issue allows an attacker to perform unauthorized actions (e.g., changing passwords) on behalf of an authenticated user by exploiting the lack of origin/referrer validation and ...

OpenMRS 跨站请求伪造漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in OpenMRS version 2.4.3 that stems from a cross-site request forgery issue that could lead to the execution of arbitrary operations...