External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between payment completion and order authorization, in...

GHSA-GM45-Q3V2-6CF8 Fast-JWT Improperly Validates iss Claims

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

SUSE-SU-2025:20154-1 Security update for python311

This update for python311 fixes the following issues: - Skip PGO with %wantreproduciblebuilds bsc1239210 - CVE-2025-0938: Disallows square brackets and in domain names for parsed URLs bsc1236705. - Configure externallymanaged with a bcond bsc1228165. - Update to 3.11.11: - Tools/Demos - gh-123418...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

Stable Channel Update for Desktop

The Stable channel has been updated to 134.0.6998.117/.118 for Windows, Mac and 134.0.6998.117 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Extended stable channel has been updated to 134.0.6998.118 for Win/Mac and will ro...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

Malicious code in tasks_mangement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5af70a269afd5435306a85b902070f929d511d8855e369cc7c930a9dc50be50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pendeck (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52144cad81187f6ac538b8ed921e0d500b9094449083bb6f7d408e5e7b6ba2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

CVE-2025-25589

CVE-2025-25589 : An XML External Entity (XXE) injection affects yimioa’s /weixin/aes/XMLParse.java, with vulnerable versions up to v2024.07.04. Attackers can execute arbitrary code by supplying a crafted XML file. The public documents confirm the component and file, and the impact is described as...

Hewlett Packard Enterprise AOS-CX（HPE AOS-CX） 安全漏洞

Hewlett Packard Enterprise AOS-CX HPE AOS-CX is a network operating system for data centers, campuses, and edges from Hewlett Packard Enterprise, Inc. It is used to provide flexible and innovative network services and enhance network performance. A security vulnerability exists in Hewlett Packard...

The vulnerability of the software environment of Siemens Tecnomatix Plant Simulation, related to the use of files and directories accessible to external parties, allows a perpetrator to delete or modify any files they desire.

The vulnerability of the software environment for simulation modeling of systems and processes in Siemens Tecnomatix Plant Simulation lies in the use of files and directories accessible to external parties. Exploiting this vulnerability could allow attackers to delete or modify any arbitrary file...

The vulnerability of the FortiClient for MAC installer allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiClient for MAC installer is related to improper external management of the file name or path to the /tmp directory. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

yimioa 安全漏洞

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from the presence of XML external entity injection in the XMLParse component, which allows an attacker to execute arbitrary co...

The vulnerability of the software environment of Siemens Tecnomatix Plant Simulation, related to the use of files and directories accessible to external parties, allows a perpetrator to delete or modify any files they desire.

The vulnerability of the software environment for simulation modeling of systems and processes in Siemens Tecnomatix Plant Simulation lies in the use of files and directories accessible to external parties. Exploiting this vulnerability could allow attackers to delete or modify any arbitrary file...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between initial entry and payment completion, in...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-2365

CVE-2025-2365 affects crmeb_java up to 1.3.4. The vulnerability resides in the WebHook function of WeChatMessageController.java, where an XML External Entity (XXE) reference can be introduced. The issue allows remote exploitation and has been publicly disclosed. CVSS metrics across sources indica...

CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...