GHSA-95RC-WC32-GM53 Gokapi vulnerable to stored XSS via uploading file with malicious file name

Impact When using end-to-end encryption, a stored XSS vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. With the affected versions v2.0, there was no user permissi...

PT-2025-23646

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions up to 1.2.1 Description A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper...

Samba Missing Re-Authentication Vulnerability (CVE-2025-0620)

Samba is prone to a vulnerability when re-authenticating an expired SMB session. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-25026

IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check...

CVE-2025-48929

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential e.g., not a token with a short expiration time that can be reused at a later date if discovered by an adversary...

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-31264

An authentication issue exists in Apple macOS caused by improper state management. An attacker with physical access to a locked device could potentially view sensitive user information . This vulnerability is addressed in macOS Sequoia 15.4 , macOS Sonoma 14.7.5 , and macOS Ventura 13.7.5 . Explo...

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-40653

User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames...

CVE-2025-25026 IBM Security Guardium information disclosure

IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check...

PT-2025-23112

Name of the Vulnerable Software and Affected Versions TeleMessage service through 2025-05-05 Description The issue concerns the implementation of authentication through a long-lived credential in the TeleMessage service, which can be reused if discovered by an adversary. This has been exploited i...

CVE-2025-48929

The TeleMessage service (version 2025-05-05 and earlier) is vulnerable to credential reuse because it implements authentication using long-lived credentials instead of short-lived tokens. An adversary who discovers these credentials can reuse them at a later date to gain unauthorized access. This...

CVE-2025-48746

Netwrix Directory Manager (formerly Imanami GroupID) is affected by a vulnerability where a critical function lacks authentication . This flaw impacts versions 11.0.0.0 and earlier , as well as versions after 11.1.25134.03 . While the technical root cause is identified as improper authentication,...

FIDO2 Authentication Does Not Work With Webpages Opened Using Microsoft Edge

Users are not able to Authenticate to a website that requires FIDO2 Authentication using a Yubikey when using Edge on VDA Devices. The users are constantly prompted to select a Smartcard device. The same users are able to Authenticate onto the same website using Chrome or Firefox inside the same...

PT-2025-22897

Name of the Vulnerable Software and Affected Versions TCMAN GIM version 11 Description A missing authentication vulnerability in TCMAN GIM version 11 allows an unauthenticated attacker to access resources such as /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser, and...

CVE-2025-33137

IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security...

CVE-2024-12093

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions...