Cross-site Scripting (XSS)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTML editor. An attacker can inject malicious scripts by sending a specifically crafted encoded payload that bypasses...

OESA-2025-1356 apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: The API is consistent among various file types...

JetBrains TeamCity Information Disclosure Vulnerability

JetBrains TeamCity is a powerful continuous integration and continuous delivery CI/CD tool developed by JetBrains. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from base64 encoded passwords being exposed in build logs. An attacker can exploit the vulnerabilit...

rack: rubygem-rack: Local File Inclusion in Rack::Static

A flaw was found in RackRubygems, where Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. This flaw allows a...

rack: rubygem-rack: Local File Inclusion in Rack::Static

A flaw was found in RackRubygems, where Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. This flaw allows a...

Low: python3

Issue Overview: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header bein...

The vulnerability of the `btrfs_encoded_read_endio()` function in the `fs/btrfs/inode.c` module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrfsencodedreadendio function in the fs/btrfs/inode.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-917)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-917 advisory. During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the...

CVE-2025-31139

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log...

CVE-2025-31139

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log...

CVE-2025-31139

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log...

CVE-2025-31139

JetBrains TeamCity prior to 2025.03 exposes base64 encoded passwords in build logs (CVE-2025-31139). Affects JetBrains TeamCity (CI/CD server); vulnerability arises from passwords being logged in base64 form. Impact: potential credential exposure. Mitigation: upgrade to version 2025.03 or later o...

CVE-2025-31139: Insertion of Sensitive Information into Log File

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log...

DEBIAN-CVE-2025-27552

DBIx::Class::EncodedColumn use the rand function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032...

CVE-2025-27552

The DBIx::Class::EncodedColumn Perl module (versions until 0.00032 ) is vulnerable because it uses the non-cryptographically secure rand() function to salt password hashes within the Crypt/Eksblowfish/Bcrypt.pm file. This leads to insufficient entropy (CWE-331) and the use of cryptographically we...

SUSE CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553

A flaw was found in Apache Commons VFS. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the resolveFile method when the scope parameter is set to NameScope.DESCENDENT. An attacker can access files outside of the intended directory by including encoded directory traversal sequences such as %2E%2E...

DEBIAN-CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553: Relative Path Traversal

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...