17635 matches found
PT-2025-115: ServerāSide Request Forgery (SSRF) in FreeScout
The vulnerability was identified in FreeScout , versions 1.8.182. The discovered vulnerability allows an attacker to send HTTP requests to external and internal resources, causing data leakage and denialāofāservice. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...
PT-2025-116: ServerāSide Request Forgery (SSRF) in FreeScout
The vulnerability was identified in FreeScout , versions 1.8.182. The discovered vulnerability allows an attacker to issue requests to restrictedāaccess servers, enabling internalānetwork reconnaissance and subsequent attacks. Vulnerability status: Confirmed by vendor Date of vulnerability...
PT-2025-32364 Ā· Xerox Ā· Xerox Freeflow Core
Name of the Vulnerable Software and Affected Versions: Xerox FreeFlow Core version 8.0.4 Description: Improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, resulting in a Server-Side Request Forgery SSRF...
Linux Distros Unpatched Vulnerability : CVE-2022-31744
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy...
Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller
CVE-2025-5777 Exploit Tool š„ A powerful educational tool...
CVE-2025-51533
An Insecure Direct Object Reference IDOR in Sage DPW v202412004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request...
Open Redirect
Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Open Redirect the trailing slash redirection logic when handling URLs with double slashes in the path. An attacker can redirect users to arbitrary external...
@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2025-54793 via @astrojs/internal-helpers (>=0.6.1, <=0.7.0)
@astrojs/internal-helpers NPM version =0.6.1, =0.0.1, =1.0.0, =12.2.4, =0.12.11, =6.2.1, =4.1.1, =6.2.3, =9.1.3, =8.1.2, =0.1.0, =0.1.0, =1.0.5, =1.25.426-4, =0.0.9, =1.3.0, =1.3.4 and more Source cves: CVE-2025-54793 Source advisory: SNYK:JS-ASTROJSINTERNALHELPERS-11508621...
Cleartext Transmission of Sensitive Information
Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the lack of HTTPS enforcement for the ACME client. An attacker can intercept sensitive information by capturing unencrypted network traffic if the library user accidentally inputs a...
CVE-2025-50234
MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...
CVE-2025-50234
MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...
Linux Distros Unpatched Vulnerability : CVE-2010-4654
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack. CVE-2010-4654 Note that Nessus relies on the presence of the packa...
AWS VDP: AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs
Issue Summary A LibreChat endpoint/UI is found to be accessible to the public Internet, with self registration for any non AWS/Amazon Corporate domains enabled, allowing an attacker to use a ChatGPT like UI to access multiple public models Example : Claude with the API access it has enabled, as...
CVE-2024-51775
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended ...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL validation process. An attacker can access internal or otherwise restricted resources by submitting a specially crafted URL that bypasses configured allowlists. Remediation Upgrade...
DINA: a Dual Defense Framework against Internal Noise and External Attacks in Natural Language Processing
As large language models LLMs and generative AI become increasingly integrated into customer service and moderation applications, adversarial threats emerge from both external manipulations and internal label corruption. In this work, we identify and systematically address these dual adversarial...
Malicious code in pexels-internal (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6750 Malicious code in pexels-internal (npm)
The package communicates with a domain associated with malicious activity...