Navidrome 安全漏洞

Navidrome is Navidrome Open Source a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device. A security vulnerability exists in Navidrome versions prior to 0.56.0, which stems from insufficient privilege validation...

VMWare Cloud Foundation Multiple Vulnerabilities (VMSA-2025-0009)

The remote host is running a version of Cloud Foundation version 4.5.x or earlier than 4.5.2.0 with Hotpatch KB398008 or 5.x earlier than 5.2.1.2. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit thi...

argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)

A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session...

GHSA-PHF6-HM3H-X8QP Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`

Summary Using Issuecomment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUBTOKEN which can be used to completely overtake the repo since the token has...

Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`

Summary Using Issuecomment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUBTOKEN which can be used to completely overtake the repo since the token has...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper filtering of repository URLs in the UI. An attacker can execute unauthorized API actions via the victim's session by injecting malicious JavaScript through crafted links. Details Cross-site...

PT-2025-24345 · Github Actions · Broadinstitute/Cromwell

Summary Using Issue comment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUB TOKEN which can be used to completely overtake the repo since the token has...

PT-2025-23137 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4 Description: This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, an...

The vulnerabilities of the functions nla_alloc_flow_actions() and ovs_nla_free_set_action() in the net_openvswitch/flow_netlink.c module of the Linux kernel allow a attacker to cause a service failure.

The vulnerabilities of the functions nlaallocflowactions and ovsnlafreesetaction in the netopenvswitch/flownetlink.c module of the Linux kernel are related to memory leaks. Exploiting these vulnerabilities could allow an attacker to cause a service failure...

Improper Authorization

pypickle is vulnerable to Improper Authorization. The vulnerability is due to insufficient access control in the Save function of pypickle/pypickle.py, allowing local attackers to perform unauthorized actions...

MAL-2025-4498 Malicious code in react_code_format (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 361ad03064f5e32012ed273f2a774a1528ef81284235b9757bb2947671dff09b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4427 Malicious code in @fmr-pr103625/apex-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87f7d6eefb4242b16b30fbedd12103828145a5d82610917904a48a2ee5b1f063 The OpenSSF Package Analysis project identified '@fmr-pr103625/apex-core' @ 1.999.2 npm as malicious. It is considered malicious because: - The...

CVE-2025-40652

CVE-2025-40652 describes a Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. The affected component is the CoverManager booking system; the root cause is described as storing malicious scripts on the server, which are then executed in the browser of any visitin...

CoverManager 跨站脚本漏洞

CoverManager is an online platform from CoverManager, Inc. that specializes in providing solutions for the hospitality industry. A cross-site scripting vulnerability exists in CoverManager that originates from stored cross-site scripting and could lead to information disclosure or execution of...

CVE-2025-48366

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persisten...

CVE-2025-33136

IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data...

Reflected Cross-Site Scripting (XSS) in module actions in edit mode

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions...

GHSA-79M3-RVX2-3QQ9 Reflected Cross-Site Scripting (XSS) in module actions in edit mode

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions...

CVE-2025-48377 Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue...

CVE-2025-48377 Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue...