Dell PowerProtect DD Information Disclosure Vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. An information disclosure vulnerability exists in Dell PowerProtect DD versions prior to 7.7.5.50, which stems from an application that does...

IBM Maximo Application Suite Cross-Site Scripting Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite. The vulnerability stems fro...

Imperva: A Leader in WAAP

Imperva – a Thales company and leading provider of Web Application and API Protection WAAP solutions, is a force to be reckoned with in the cybersecurity landscape. Our comprehensive approach to security, encompassing database security, enterprise application security, bot management, DDoS...

ChuanhuChatGPT Information Disclosure Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An information disclosure vulnerability exists in ChuanhuChatGPT version 20240628, which can be exploited by an attacker to gain access to...

ChuanhuChatGPT Resource Management Error Vulnerability (CNVD-2025-06195)

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A resource management error vulnerability exists in ChuanhuChatGPT version 20240628, which stems from uncontrolled resource consumption that...

Qualys Web Application Scanning (WAS) Recognized as a Leader in 2024 GigaOm Radar Report for Application Security Testing (AST)

In the ever-evolving cybersecurity landscape, securing web applications and APIs is no longer an option—it’s a necessity. As organizations face increasingly complex threats, ensuring the integrity of these digital assets has become paramount. However, it’s easy to feel overwhelmed by the sheer...

Amazon Linux 2 : python3 (ALAS-2024-2687)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2687 advisory. The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion ...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2024-746)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-746 advisory. Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an...

CVE-2024-38821

CVE-2024-38821 affects Spring WebFlux with Spring Security static resource rules. A bypass is possible when a non-permitAll authorization rule is applied to Spring’s static resources and the resources are served by a WebFlux app using Spring’s static resources support. Documents confirm this CVE ...

CVE-2024-45714

Application is vulnerable to Cross Site Scripting XSS an authenticated attacker with users’ permissions can modify a variable with a payload...

Command Execution Vulnerability in ANYSEC Second Generation Firewall of Shenzhen Zhongke NetWizard Technology Co.

ANYSEC's second-generation firewall is a new generation of application security gateway products for comprehensive L2-L7 security in the mobile Internet era. Ltd. ANYSEC second generation firewall has a command execution vulnerability that can be exploited by attackers to gain control of the serv...

CVE-2024-8602 XML Eternal Entity Attack in the Software Library taxstatement.jar

When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE XML External Entity attack. Further information on this can be found on the website of the Open Worldwide Application Security Project OWASP. An attacker...

SAP HANA Node.js client package vulnerable to Prototype Pollution

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact ...

The vulnerability of the Next.js software platform for creating web applications lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

Sentry SDK Prototype Pollution gadget in JavaScript SDKs

Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue. !NOTE This...

Cross Site Scripting(XSS)

github.com/alist-org/alist is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to inadequate input validation in the /i/:linkname endpoint, which fails to sanitize user-provided values, allowing malicious HTML tags to be executed in the application context...

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromisin...

xmlsec1 bug fix update

An update is available for xmlsec1. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XML Security Library is a C library based on LibXML2 and OpenSSL. The library...

VulnCheck KEV: CVE-2024-2330

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The...

Flask Weak Secret Key

Flask applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data,...