5413 matches found
CVE-2025-2748 Kentico Xperience stored cross-site scripting in multiple-file upload functionality
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178...
Imperva Named a Leader in Forrester Wave™: Web Application Firewall (WAF) Solutions: A Continued Legacy of Excellence
In today’s digital-first environment, protecting web applications and APIs is a critical priority for businesses. Organisations seek trusted solutions that balance robust protection, scalability, and ease of use. It’s no surprise that Imperva has been named a Leader in the Forrester Wave: Web...
GHSA-FJCF-3J3R-78RP LiteLLM Has an Improper Authorization Vulnerability
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...
CVE-2024-8065 CSRF in danswer-ai/danswer
A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...
CVE-2024-7999
CVE-2024-7999 is rejected/not used; refer to CVE-2024-53981.
CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui
A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...
This Week in Spring – March 18th, 2025
Hi, Spring fans! I just got back from the amazing JavaOne show held in Redwood Shores. It was a fun, uproarious event and a great chance to reconnect with tons of friends, old and new. I love this community! One of the central highlights of this show? Java 24 is here, finally! And, as usual, we'v...
CVE-2025-29426
creationtimestamp| type| source ---|---|--- 2025-03-17 20:47:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7856 2025-03-17 23:19:58+00:00| seen| https://t.me/cvedetector/20520 2025-03-18 00:01:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkmegyysk...
CVE-2025-2379
creationtimestamp| type| source ---|---|--- 2025-03-17 13:46:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7768 2025-03-17 16:33:08+00:00| seen| Telegram/tbvVbz5ekkGAeSawYQoMdEeMb-2G-PfhhFRvwFDUo-eDBI 2025-03-17 17:28:12+00:00| seen| https://t.me/cvedetector/20479...
Akamai
Akamai CVE-2025-30143 - WAF Bypass in Akamai ASE Applicat...
CVE-2025-2366
creationtimestamp| type| source ---|---|--- 2025-03-17 07:46:19+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7740 2025-03-17 09:06:05+00:00| seen| https://t.me/cvedetector/20433 2025-03-17 09:46:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkkuoludq...
CVE-2025-25245
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...
CVE-2025-29997
CVE-2025-29997 affects the CAP back office application. The root cause is improper authorization checks on certain API endpoints, allowing an authenticated remote attacker to manipulate API request URLs and gain unauthorized access to other user accounts. The vulnerability is rated HIGH (CVSS 4.0...
CVE-2025-25242
CVE-2025-25242 affects SAP NetWeaver Application Server ABAP. The vulnerability involves cross-site scripting (XSS) through execution of malicious scripts in the ABAP application, with no impact on availability and only minor impact on confidentiality and integrity as described. Affects the SAP N...
CVE-2025-24387 Missing CSRF protection
A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...
CVE-2025-2123
creationtimestamp| type| source ---|---|--- 2025-03-09 15:37:29+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6967 2025-03-09 17:57:00+00:00| seen| https://t.me/cvedetector/19926 2025-03-09 19:05:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljxq6qdad...
Webinar: Learn How ASPM Transforms Application Security from Reactive to Proactive
Are you tired of dealing with outdated security tools that never seem to give you the full picture? You're not alone. Many organizations struggle with piecing together scattered information, leaving your apps vulnerable to modern threats. That's why we're excited to introduce a smarter, unified...
CVE-2025-2063
creationtimestamp| type| source ---|---|--- 2025-03-07 04:34:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6796 2025-03-07 06:02:24+00:00| published-proof-of-concept| Telegram/5yp7nL0030ls3Gne3VU8N-XFXoAZlf1wMfRIbXn0P0E5M 2025-03-07 06:34:22+00:00| seen|...