CVE-2025-32357

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for...

CVE-2025-32357

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for...

PT-2025-15070 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue allows an authenticated agent with knowledge base permissions to use the Zammad API to fetch knowledge base content that they have no permission for. Recommendations: For versions 6.4...

CVE-2025-32357

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for...

CVE-2025-32357

The CVE-2025-32357 entry affects Zammad versions 6.4.x before 6.4.2. An authenticated agent with knowledge base permissions can use the Zammad API to fetch knowledge base content they are not authorized to access, indicating an API permission bypass vulnerability with potential information disclo...

WordPress plugin KB Support 信息泄露漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure vulnerability exists in...

CVE-2025-32357

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.4.2, which stems from an authenticated agent being able to access unprivileged knowledge base content...

CVE-2025-32357

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for...

Azure File Sync Agent v20.0 Release – February 2025 (KB5041884)

Update Rollup for Azure File Sync agent version 20.0.0.0. For more details, see the associated Microsoft Knowledge Base article...

ServiceNow Public Knowledge Base Detected

ServiceNow offers a knowledge management module to help organizations sharing internal or public information to help in their service usages. This informational plugin detects the presence of public knowledge bases on the target ServiceNow instance. No source data...

CVE-2024-8027

A stored Cross-Site Scripting XSS vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix...

Uncontrolled Recursion

Overview llama-index-readers-web is a llama-index readers web integration Affected versions of this package are vulnerable to Uncontrolled Recursion via the KnowledgeBaseWebReader class's getarticleurls function. An attacker can trigger a crash by supplying a URL to an object containing an href...

CVE-2024-8026

A Cross-Site Request Forgery CSRF vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating,...

CVE-2024-8027

A stored Cross-Site Scripting XSS vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix...

CVE-2024-8027

CVE-2024-8027 is a stored Cross-Site Scripting (XSS) vulnerability in netease-youdao/QAnything. According to Red Hat and NVD entries, attackers can upload a malicious knowledge file to the knowledge base, triggering XSS during user chats. Affected scope: all versions prior to the fix; explicit re...

NetEase QAnything 跨站脚本漏洞

NetEase QAnything is a local knowledge base question and answer system from China's NetEase, Inc. that is designed to support files or databases in any format, and can be installed and used offline. A cross-site scripting vulnerability exists in NetEase QAnything. An attacker can exploit this...

2025-03 Cumulative security Hotpatch for Azure Stack HCI, version 21H2 and Windows Server 2022 Datacenter: Azure Edition for x64-based Systems (KB5053638)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information...

2025-03 Cumulative Update for Windows 10 Version 21H2 for ARM64-based Systems (KB5053606)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

2025-03 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5053603)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...