121 matches found
Romm 安全漏洞
Romm is a beautiful, powerful, self-hostable ROM manager and player open-sourced by The RomM Project. A security vulnerability exists in Romm versions prior to 4.4.1 and prior to 4.4.1-beta.2, which stems from a lack of ownership validation and could lead to reading other users' private collectio...
EUVD-2025-200099
Grav vulnerable to Cross-Site Scripting XSS Stored endpoint /admin/pages/page in Multiples parameters...
CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...
CVE-2025-66304 Grav Exposes Password Hashes Leading to privilege escalation
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack thes...
CVE-2025-66294 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by...
A New Security Layer for macOS Takes Aim at Admin Errors Before Hackers Do
A design firm is editing a new campaign video on a MacBook Pro. The creative director opens a collaboration app that quietly requests microphone and camera permissions. MacOS is supposed to flag that, but in this case, the checks are loose. The app gets access anyway. On another Mac in the same...
Linux Distros Unpatched Vulnerability : CVE-2025-9384
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpeditpostargs of the file /src/tcpedit/parseargs.c. The manipulation...
OPENSUSE-SU-2025:15401-1 liblua5_5-5-5.5.0~beta1-1.1 on GA media
These are all security issues fixed in the liblua55-5-5.5.0beta1-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2023-22468
Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...
CVE-2022-41921
Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been...
📄 Economizzer 0.9-beta1 Session Invalidation
Economizzer version 0.9-beta1 fails to properly invalidate user sessions. A session management vulnerability exists in gugoan's Economizzer v.0.9-beta1. The application fails to properly invalidate user sessions upon logout or other session termination events. As a result, a valid session remains...
libreswan bug fix and enhancement update
An update is available for libreswan. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9....
pki-core bug fix and enhancement update
An update is available for pki-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...
linux-firmware bug fix and enhancement update
An update is available for linux-firmware. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Lin...
ledmon bug fix and enhancement update
An update is available for ledmon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...
Moderate: Red Hat Bug Fix Advisory: Red Hat build of Apicurio Registry 3.0.6 Beta OpenShift images
3.0.6 Beta release of Red Hat build of Apicurio Registry. This advisory makes available an update to the Red Hat build of Apicurio Registry images...
UBUNTU-CVE-2024-23451
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to...
Nothing Chats pulled from Google Play
Sometimes it’s all in the name. The Nothing Chats beta has been pulled from the Google Play Store after reports that the company behind it has access to your unencrypted messages. Nothing Phone 2 owners were promised a first-of-its-kind app developed in partnership with Sunbird, which allowed the...
Economizzer Security Vulnerabilities
Economizzer is a simple and open source personal finance management system using PHP Yii Framework 2 by Gustavo G. Andrade, an individual developer. A security vulnerability exists in Economizzer v.0.9-beta1, which stems from a user enumeration vulnerability that could allow an attacker to...
