CVE-2025-64717 ZITADEL vulnerable to Account Takeover with deactivated Instance IdP

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding Id...

CVE-2025-64717 ZITADEL vulnerable to Account Takeover with deactivated Instance IdP

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding Id...

CVE-2025-64717: Improper Authentication

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding Id...

CVE-2023-28331

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk...

CVE-2023-28331

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk...

UBUNTU-CVE-2023-28331

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk...

cmark-gfm 资源管理错误漏洞

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version with canonical Markdown syntax. A resource management error vulnerability exists in versions prior to cmark-gfm 0.29.0.gfm.6, which stems from a polynomial time complexity issue in the...

PT-2023-21654 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: Database auto-linking filter affected versions not specified Description: The issue arises from the database auto-linking filter's output requiring additional sanitizing to prevent a cross-site scripting XSS risk. This implies that without...

GitLab: Claiming package names in GitLab's automatic package referencer.

Hi team, GitLab has a pretty neat feature that auto-links packages to their respective registry. The problem is that GitLab currently assumes that packages have been uploaded to a registry by default. For example, if no homepage key is pointing to GitLab in a package.json file, Gitlab assumes tha...