PT-2025-17929 · Unknown · Filez Client

Name of the Vulnerable Software and Affected Versions: FileZ client affected versions not specified Description: An open redirect issue was reported in the FileZ client, potentially leading to information disclosure if a local user visits a crafted URL. Recommendations: At the moment, there is no...

Cross-Site Scripting (XSS)

@sveltejs/kit is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization of search parameter names when iterating over event.url.searchParams in server load functions, allowing attackers to inject malicious scripts via crafted URLs...

EulerOS 2.0 SP11 : wget (EulerOS-SA-2025-1382)

According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these...

Information Exposure

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Information Exposure due to the handling of req.url which may contain unexpected characters such as . An attacker can access and retrieve the contents of arbitrary files by...

CVE-2025-32371 Unexpected external content may be displayed in DNN ImageHandler

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that t...

CVE-2025-27914

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting XSS vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token...

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

...

PT-2025-6127 · Sap · Sap Businessobjects Bi Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Platform BI Launchpad affected versions not specified Description: The issue arises from insufficient handling of user input, resulting in a Cross-Site Scripting XSS vulnerability. This allows an unauthenticated attacker t...

CVE-2024-6973

Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34...

Git LFS permits exfiltration of credentials via crafted HTTP URLs

...

git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Gi...

git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Gi...

git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Gi...

FreeBSD : git -- multiple vulnerabilities (3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8 advisory. Git development team reports: CVE-2024-50349: Printing unsanitized URLs when asking for...

GHSA-Q6R2-X2CC-VRP7 Git LFS permits exfiltration of credentials via crafted HTTP URLs

Impact When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host...

CVE-2024-53263 Git LFS permits exfiltration of credentials via crafted HTTP URLs

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

CVE-2024-42171

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...

CVE-2024-42170

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...

CVE-2024-42171 HCL MyXalytics is affected by insufficient session expiration

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...

CVE-2024-42170 HCL MyXalytics is affected by a session fixation vulnerability

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session...