17 matches found
CVE-2026-39425
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting XSS vulnerability that allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue Opening Remarks field by wrapping malicious payloads in tags...
How to Get a Reddit API Key in 2026: Step-by-Step Guide
Getting a Reddit API key starts with creating an application through Reddit’s developer portal and understanding how its…...
CVE-2025-58426: Use of Hard-coded Cryptographic Key
desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...
CVE-2025-58079: Improper Protection of Alternate Path
Improper Protection of Alternate Path CWE-424 in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications...
CVE-2023-25163
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...
CVE-2025-4323
creationtimestamp| type| source ---|---|--- 2025-05-06 05:20:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15056 2025-05-06 06:21:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loiajnhvm42h 2025-05-06 08:37:08+00:00| published-proof-of-concept|...
CVE-2025-27417
creationtimestamp| type| source ---|---|--- 2025-03-03 16:30:47+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6238 2025-03-03 18:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljim7ibs752a 2025-08-19 13:26:46+00:00| seen|...
CVE-2024-7298
creationtimestamp| type| source ---|---|--- 2025-02-11 02:19:42+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhulumovws2z...
CVE-2024-42166
The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...
CVE-2024-52054 Application Creation Path Traversal in Wowza Streaming Engine
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system...
CVE-2024-42167 Command Injection in Organisationname
The function "generateappcertificates" in controllers/saml2/saml2.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicio...
CVE-2024-42166 Command Injection in Applicationname
The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...
CVE-2024-22424
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...
Microsoft Defender for Endpoint: Why You May Need It and How to Export Hosts via API in Python
Hello everyone! In this episode, I want to talk about Microsoft Defender for Endpoint. It’s not a well-known free Defender antivirus built in Windows 10, but an enterprise level solution with the similar name. Yes, the naming is pretty confusing. I will not repeat Microsofts marketing thesis. Jus...
CVE-2020-3975: Improper Neutralization of Input During Web Page Generation
VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting XSS vulnerability. A malicious actor with access to create and edit applications or create storage groups, may be able to inject malicious script which will be executed by a victim'...
Stripo Inc: csrf bypass using flash file + 307 redirect method at plugins endpoint
Hi Security team, i have found that the request sent to https://my.stripo.email/cabinet/stripeapi/v1/plugin/$userid$/plugins don't have any protection against csrf attacks as the server only validates that the content type is application/json and this can be bypassed using the flash file + 307...
