PT-2025-1913 · WordPress · Passwords Manager

Name of the Vulnerable Software and Affected Versions: Passwords Manager plugin for WordPress versions up to, and including, 1.4.8 Description: The issue is related to a missing capability check on the pms save setting and post new pass AJAX actions. This allows authenticated attackers with...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE arises from improper handling of user actions, allowing unauthorized access to protected information by attackers.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to improper management of user actions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-55921 Cross-Site Request Forgery in Extension Manager Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

GHSA-8MV3-37RC-PVXJ TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery

Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...

TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery

Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...

Description of the security update for SharePoint Enterprise Server 2016: January 14, 2025 (KB5002672)

None None...

PT-2025-4761 · Linksys · Linksys E5600 Router

Name of the Vulnerable Software and Affected Versions: Linksys E5600 Router version 1.1.0.26 Description: A stored cross-site scripting XSS issue in the prf table content component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter. Th...

Security Bulletin: IBM Engineering Lifecycle Management is impacted by vulnerabilities in Apache Jena

Summary A vulnerability has been identified in Apache Jena - jena-core-2.7.1.jar, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2021-39239 DESCRIPTION: Apache...

CISA: Actions to Improve Chemical Facility Safety and Security - a Shared Commitment (Report for the President, May 2014)

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CVE-2025-23111

An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website...

CVE-2024-47520

A user with advanced report application access rights can perform actions for which they are not authorized...

CVE-2024-47520

A user with advanced report application access rights can perform actions for which they are not authorized...

CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized

A user with advanced report application access rights can perform actions for which they are not authorized...

CVE-2024-47520

Summary of CVE-2024-47520 (Arista NGFW/ETM): A user with advanced reporting application access rights can perform actions beyond authorization. Documented as part of Arista Security Advisory 0105, the issue is tied to the reporting component and allows privilege misuse by users with limited admin...

CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized

A user with advanced report application access rights can perform actions for which they are not authorized...

Denial Of Service (DoS)

Next.js is vulnerable to a Denial of Service DoS. The vulnerability is due to requests to Server Actions hanging indefinitely, causing the server to remain idle with the connection open, allows an attacker to keep the connection open until the hosting provider cancels the function, leading to...