31561 matches found
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules (CVE-2025-64718, CVE-2025-64756, CVE-2025-13466 & CVE-2025-65945)
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to node modules js-yaml, glob, body-parser and jws. Vulnerability Details...
CVE-2025-11544
creationtimestamp| type| source ---|---|--- 2025-12-22 07:24:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115762020342462503 2025-12-22 07:36:05+00:00| seen| https://infosec.exchange/users/offseq/statuses/115762067143750160 2025-12-22 07:36:06+00:00| seen|...
CVE-2025-65817
LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in startapp.sh...
LSC Smart Connect Indoor IP Camera 安全漏洞
LSC Smart Connect Indoor IP Camera is an indoor IP camera driver from LSC Smart Connect. A security vulnerability exists in LSC Smart Connect Indoor IP Camera version 1.4.13, which stems from a remote code execution vulnerability in startapp.sh...
WordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Rapid0nion in WordPress Plugin E-Invoice App Malaysia versions = 1.3.0...
CVE-2025-9808
creationtimestamp| type| source ---|---|--- 2025-12-20 21:03:01+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mah44ete6i2t...
CVE-2023-53941
EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads through the appservicecontrol parameter. Attackers can send POST requests to /index.php?zone=settings with crafted...
CVE-2025-67712 HTML injection issue in ArcGIS Web App Builder
There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript...
EUVD-2025-204564
Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting XSS vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary...
Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to denial of service and loss of integrity [CVE-2025-12816, CVE-2025-66030, CVE-2025-66031]
Summary Node.js module node-forge is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands are vulnerable to denial of service and loss of integrity. This bulletin provides patch information to...
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Neutralization of Input Terminators due to Jakarta Mail (CVE-2025-7962)
Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Neutralization of Input Terminators due to Jakarta Mail. Vulnerability Details CVEID:CVE-2025-7962 DESCRIPTION: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \...
CVE-2025-68489
creationtimestamp| type| source ---|---|--- 2025-12-19 07:22:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mad5rqgvir2e...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Incomplete Filtering of One or More Instances of Special Elements due to node module validator (CVE-2025-12758)
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to Incomplete Filtering of One or More Instances of Special Elements due to node module validator. Vulnerability Details...
EUVD-2025-204426
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub Ap...
CVE-2025-67844
The Mintlify Platform’s GitHub Integration API (pre-2025-11-15) fails to validate that configured repository owner/name belong to the user’s GitHub App Installation ID, enabling disclosure of sensitive repository metadata. Multiple sources corroborate the issue and cite the same root cause in the...
Apple macOS Tahoe Insufficient Authentication Vulnerability
Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from an insufficient authentication vulnerability that can be exploited by an attacker to cause...
CVE-2025-64663
creationtimestamp| type| source ---|---|--- 2025-12-18 23:31:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3macdhl6lso2y 2025-12-19 05:34:54+00:00| seen| https://infosec.exchange/users/offseq/statuses/115744603727230384...
CVE-2025-14850
creationtimestamp| type| source ---|---|--- 2025-12-18 23:11:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maccf27sx22u...
CVE-2025-63950
An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b 2023-02-28. The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize function without validation...
Cross-site Scripting (XSS)
Overview Kentico.Xperience.AspNetCore.WebApp is an assemblies and content items required to integrate Kentico Xperience into ASP.NET Core applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS through dangerous schemes allowed in the HtmlSanitizer class in the...