12 matches found
CVE-2025-1888
The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting XSS. An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a...
CVE-2025-61950
In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...
CVE-2025-61950
In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...
EUVD-2025-203022
In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...
CVE-2025-61950
In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...
PT-2025-50875
Name of the Vulnerable Software and Affected Versions GroupSession Free edition versions prior to 5.3.0 GroupSession byCloud versions prior to 5.3.3 GroupSession ZION versions prior to 5.3.2 Description A flaw exists in GroupSession where a Circular notice can be created with a non-editable memo...
CVE-2025-61950: Authorization Bypass Through User-Controlled Key
In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...
EUVD-2025-6445
Malicious code in bioql PyPI...
CVE-2025-1888
CVE-2025-1888 affects the Leica Web Viewer component of the Aperio Eslide Manager Application. A reflected XSS vulnerability exists in the memo field used to annotate slides; an authenticated user can trigger execution by injecting malicious JavaScript via the memo hover/tooltip interface, which ...
CVE-2025-1888: Improper Neutralization of Input During Web Page Generation
The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting XSS. An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a...
PT-2025-11281
Name of the Vulnerable Software and Affected Versions: Aperio Eslide Manager Application affected versions not specified Description: The issue concerns reflected cross-site scripting XSS within the Leica Web Viewer component of the Aperio Eslide Manager Application. An authenticated user can...
Typing Incriminating Evidence in the Memo Field
Dont do it: Recently, the manager of the Harvard Med School morgue was accused of stealing and selling human body parts. Cedric Lodge and his wife Denise were among a half-dozen people arrested for some pretty grotesque crimes. This part is also at least a little bit funny though: Over a three-ye...