Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.5

Red Hat OpenShift Service Mesh 3.0.5 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.0....

PT-2025-38160

Name of the Vulnerable Software and Affected Versions: Apache::AuthAny::Cookie versions 0.201 and earlier Description: The software generates session IDs insecurely using an MD5 hash of the epoch time and the rand function. The epoch time may be guessable if not concealed by the HTTP Date header,...

MetaCPAN Apache::AuthAny::Cookie 安全漏洞

MetaCPAN Apache::AuthAny::Cookie is a Perl authentication module from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN Apache::AuthAny::Cookie version 0.201 and earlier, which stems from the use of MD5 hash and rand functions to generate insecure session IDs, which could lead ...

CVE-2025-57145

A cross-site scripting XSS vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the...

CVE-2025-56276

code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting XSS in the registration function. An attacker enters malicious JavaScript code as a username, which triggers the XSS vulnerability when the admin views user information, resulting in the disclosure of the admin's...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the formtodatabase exten. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious input. Details Cross-site scripting or XSS is a code vulnerability that occurs...

curl: Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE

Summary I discovered a critical stack-based buffer overflow vulnerability in cURL's cookie parsing mechanism that can lead to remote code execution. The vulnerability occurs when processing maliciously crafted HTTP cookies, affecting all applications that use libcurl for HTTP requests. Descriptio...

CVE-2025-56276

CVE-2025-56276 affects Code-Projects Food Ordering Review System 1.0. The vulnerability is a Cross-Site Scripting (XSS) in the registration function: an attacker can inject malicious JavaScript as a username, which executes when an administrator views the user information, potentially exposing th...

CVE-2025-56289

CVE-2025-56289 affects Code-Projects Document Management System v1.0. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by failure to filter yet in the Company field during file uploads, allowing an attacker to exfiltrate the administrator’s cookies. Reported impact is limited to cook...

CVE-2025-57145

A cross-site scripting XSS vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the...

CVE-2025-57145

CVE-2025-57145 concerns an XSS in the ATSMS web application, specifically the search-autootaxi.php endpoint. The issue arises from improper sanitization of form input, allowing a attacker-supplied JavaScript payload to be stored in the backend and executed when an affected report page is viewed. ...

PT-2025-38006

Name of the Vulnerable Software and Affected Versions: ATSMS web application affected versions not specified Description: A cross-site scripting XSS issue exists in the search-autootaxi.php endpoint of the ATSMS web application. The application does not properly sanitize user input submitted...

CVE-2025-56276

code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting XSS in the registration function. An attacker enters malicious JavaScript code as a username, which triggers the XSS vulnerability when the admin views user information, resulting in the disclosure of the admin's...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input when handling InternetDomainName values. An attacker can access cookies set by the application across subdomains by controlling a website that shares the same top-level domain...

CVE-2025-58177 n8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter

n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting XSS vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages...

CVE-2025-43793

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, whic...

CVE-2025-43793

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, whic...

CVE-2025-43793

CVE-2025-43793 affects Liferay Portal (7.4.0–7.4.3.105) and Liferay DXP (2023.Q4.0, 2023.Q3.1–2023.Q3.4, 7.4 GA–update 92, 7.3 GA–update 35). The issue is improper subdomain/domain subcomponent identification that can create a supercookie, enabling remote attackers controlling a website sharing t...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect due to a failure to validate the redirectto parameter. An attacker can exfiltrate user cookies by tricking a user into authenticating with their SAML provider using a crafted link that redirects them to an...

Mattermost Open Redirect vulnerability

Mattermost versions 10.10.x = 10.10.1, 10.5.x = 10.5.9, 10.9.x = 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL...