5357 matches found
CVE-2025-3426
We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-enginee...
CVE-2024-56475
creationtimestamp| type| source ---|---|--- 2025-04-02 19:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llu3i4vig224 2025-04-02 20:50:51+00:00| seen| https://t.me/cvedetector/21910...
Internet Bug Bounty: Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
The Apache Airflow Fab Provider before version 1.5.2 was affected by an insufficient session expiration vulnerability. When a user's password was changed using the admin CLI, the existing user sessions were not cleared, allowing logged-in users to continue accessing the system even after the...
PT-2025-14129 · Unknown · Leadquizzes
Name of the Vulnerable Software and Affected Versions: LeadQuizzes versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious script...
PT-2025-14268 · Infoway Llc · Infoway Llc Ebook Downloader
Name of the Vulnerable Software and Affected Versions: Infoway LLC Ebook Downloader versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...
Cross-site Scripting (XSS)
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Title/Body source fields. An attacker can inject malicious scripts by crafting malicious input to these fields. Details...
CVE-2025-1734
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when receiving headers from HTTP server, the headers missing a colon : are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers...
The vulnerability of the Application Security (AppSec) module of a software platform based on Git for collaborative code development on GitLab allows attackers to perform cross-site scripting attacks.
The vulnerability of the Application Security AppSec module of a Git-based software development platform for collaborative code editing on GitLab is related to the lack of protective measures for website structures. Exploiting this vulnerability allows an attacker operating remotely to perform...
CVE-2025-2909 Lack of encryption vulnerability in DuoxMe
The lack of encryption in the DuoxMe formerly Blue application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information...
CVE-2025-2909 Lack of encryption vulnerability in DuoxMe
The lack of encryption in the DuoxMe formerly Blue application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information...
CVE-2025-2909
CVE-2025-2909 affects DuoxMe (iOS) prior to version 3.3.1. The root cause is lack of encryption in the application binary, allowing an attacker to gain unauthorised access to the app code and discover sensitive information. Public details in connected documents explicitly describe the vulnerabili...
CVE-2025-30847
CVE-2025-30847: Stored XSS in the Novelist WordPress plugin (Novelist) affecting versions up to 1.2.3. Exploitation requires authentication (Administrator+). Patch available to address the issue; affected range is from n/a through 1.2.3; CVSS v3.1 base score 5.9 (Medium).
PT-2025-13000 · Gitlab · Gitlab Ce/Ee
Name of the Vulnerable Software and Affected Versions: Gitlab EE/CE versions 13.5.0 through 17.8.6 Gitlab EE/CE versions 17.9 through 17.9.3 Gitlab EE/CE versions 17.10 through 17.10.1 Description: An issue has been discovered in Gitlab EE/CE for AppSec affecting certain versions. Certain error...
ROS-20250326-04
A vulnerability in the Ruby Sinatra web application development framework is related to causing an Open Redirect Attack Attack by inserting an arbitrary address into this header. Exploiting the vulnerability allows an attacker, acting remotely, to gain access to sensitive data...
How to Create a Scan in Perl to Identify Vulnerable Telnet Servers
This paper, written in Brazilian Portuguese, explains how to create a Perl script to identify vulnerable telnet servers. In the context of application security, the author provides mitigation recommendations...
CVE-2025-2748 Kentico Xperience stored cross-site scripting in multiple-file upload functionality
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178...
Imperva Named a Leader in Forrester Wave™: Web Application Firewall (WAF) Solutions: A Continued Legacy of Excellence
In today’s digital-first environment, protecting web applications and APIs is a critical priority for businesses. Organisations seek trusted solutions that balance robust protection, scalability, and ease of use. It’s no surprise that Imperva has been named a Leader in the Forrester Wave: Web...
GHSA-FJCF-3J3R-78RP LiteLLM Has an Improper Authorization Vulnerability
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...
CVE-2024-8065 CSRF in danswer-ai/danswer
A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...