CVE-2025-23184 Apache CXF: Denial of Service vulnerability with temporary files

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system it applies to servers and clients...

CVE-2024-37600

creationtimestamp| type| source ---|---|--- 2025-01-17 13:35:06+00:00| seen| https://poliverso.org/objects/0477a01e-45ff02b8-52616ac586aa8672 2025-02-13 23:15:45+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li3sygspqb2s 2025-02-14 00:35:16+00:00| seen|...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-45102

Lenovo XClarity Administrator (LXCA) privilege escalation vulnerability (CVE-2024-45102) could allow a valid, authenticated LXCA user to elevate privileges for a connected XCC instance when LXCA is used as the SSO provider. Exploitation status is not detailed in the provided sources; CVSS 3.1 bas...

CVE-2024-57214

creationtimestamp| type| source ---|---|--- 2025-01-10 17:13:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113805177905577491 2025-01-10 17:16:13+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lffp2ajssg2f 2025-01-10 17:54:11+00:00| seen|...

PT-2025-4340

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, which prevented accessing NAPI instances from another namespace. The NAPI IDs were not fully exposed to user space prior to the...

PT-2024-12773 · Beyondtrust · Beyondtrust Remote Support

Name of the Vulnerable Software and Affected Versions: BeyondTrust Remote Support SaaS affected versions not specified Description: A security issue allowed hackers to exploit and breach Remote Support SaaS instances, resulting in the resetting of local account passwords. The incident led to the...

CVE-2024-52590 Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

GHSA-HVM9-WC8J-MGRC TShock Security Escalation Exploit

Impact An issue with the way OTAPI manages client connections results in stale UUIDs remaining on RemoteClient instances after a player disconnects. Because of this, if the following conditions are met a player may assume the login state of a previously connected player: 1. The server has UUID...

Misskey 输入验证错误漏洞

Misskey is a perpetually free open source federated social media platform from Misskey Open Source. An input validation error vulnerability exists in Misskey version 2024.10.1 and earlier, which stems from a lack of validation that could allow an attacker to create fake user profiles and forged...

Citrix workspace app for Windows issues with "limit instances"

If the user clicks multiple times on a published application it will launch several instances of the application even if "Limit to one instance per user" is set on the application...

CVE-2024-49147

creationtimestamp| type| source ---|---|--- 2024-12-12 19:13:05+00:00| seen| https://infosec.exchange/users/cve/statuses/113641441491376096 2024-12-12 19:56:06+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113641610646102864 2024-12-12 21:21:56+00:00| seen|...

CVE-2024-49581

CVE-2024-49581 affects Palantir Foundry (Apollo-managed Foundry instances). A software bug in Restricted Views backed objects (OSV1) could be bypassed under specific circumstances, allowing users without permission to view such objects via the Object Explorer. The issue did not enable cross-organ...

CVE-2024-49581 Access control issue impacting RV backed objects

Restricted Views backed objects OSV1 could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available...

CVE-2024-49581 Access control issue impacting RV backed objects

Restricted Views backed objects OSV1 could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available...

Gitlab -- vulnerabilities

Gitlab reports: Unauthorized access to Kubernetes cluster agent Device OAuth flow allows for cross window forgery Denial of Service by importing malicious crafted FogBugz import payload Stored XSS through javascript URL in Analytics dashboards HTML injection in vulnerability Code flow could lead ...

CVE-2024-50386

CVE-2024-50386 affects Apache CloudStack where by default, derived KVM-compatible templates can be registered for download to primary storage. The root cause is missing validation checks for KVM templates in CloudStack versions 4.0.0–4.18.2.4 and 4.19.0–4.19.1.2. An attacker able to register temp...

CVE-2024-50386: Improper Input Validation

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker...

CVE-2024-51695

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yes We Work Fabrica Synced Pattern Instances fabrica-reusable-block-instances allows Reflected XSS.This issue affects Fabrica Synced Pattern Instances: from n/a through = 1.0.8...

CVE-2024-51695 WordPress Fabrica Synced Pattern Instances plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yes We Work Fabrica Synced Pattern Instances fabrica-reusable-block-instances allows Reflected XSS.This issue affects Fabrica Synced Pattern Instances: from n/a through = 1.0.8...