21243 matches found
EUVD-2025-198234
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference IDOR vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the...
Security Bulletin: Astronomer with IBM is vulnerable to several issues due to open source packages
Summary Open source software is used by Astronomer with IBM as part of overall processing functionality. Vulnerability Details CVEID:CVE-2005-2541 DESCRIPTION: Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gai...
CVE-2025-63800
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...
[SECURITY] Fedora 41 Update: firefox-145.0-2.fc41
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
PT-2025-47519
Name of the Vulnerable Software and Affected Versions OpenSTAManager versions prior to 2.9.5 Description OpenSTAManager is a management software for technical assistance and invoicing. A SQL Injection flaw exists in the API that allows authenticated users to execute arbitrary SQL queries,...
PT-2025-47516
Name of the Vulnerable Software and Affected Versions Homarr versions prior to 1.43.3 Description A stored cross-site scripting XSS issue exists in Homarr Dashboard. The issue allows the execution of arbitrary JavaScript in a user's browser with minimal user interaction. This is due to the...
PT-2025-47501
Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4 Description Rallly is a scheduling and collaboration tool. An Insecure Direct Object Reference IDOR exists in the poll duplication endpoint /api/trpc/polls.duplicate. An authenticated user can bypass access...
Astro security vulnerabilities
Astro is an Astro open source web framework for content-driven websites. A security vulnerability exists in Astro versions prior to 5.15.8, which stems from a reflected cross-site scripting vulnerability in the server island function that could lead to malicious code execution...
RNP security vulnerabilities
RNP is a C++ library open-sourced by RNP. A security vulnerability exists in RNP that stems from improper PKESK session key generation...
i-Educar SQL Injection Vulnerability
i-Educar is a free educational software from Portábilis open source. A SQL injection vulnerability exists in i-Educar version 2.10.0 and earlier, which stems from improper handling of the codagenda parameter and could lead to a SQL injection attack...
CVE-2025-61661
creationtimestamp| type| source ---|---|--- 2025-11-18 18:38:59+00:00| seen| https://seclists.org/oss-sec/2025/q4/198 2025-11-18 21:58:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5wqbwr4cr2w 2026-03-19 00:00:00+00:00| seen|...
Admin Tools Application Security Vulnerabilities
Admin Tools Application is an advanced administration tool for XWiki open-sourced by the XWiki Foundation. A security vulnerability exists in versions of Admin Tools Application prior to 1.1, which stems from improper access control and could lead to non-administrative users accessing...
PT-2025-47338
Name of the Vulnerable Software and Affected Versions Open Source Point of Sale version 3.4.1 Description The password change functionality has a flaw where a user can set an empty password due to a lack of server-side validation. Omitting or providing empty values for the password and repeat...
CVE-2025-63800: Weak Password Requirements
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...
EUVD-2025-198040
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...
CVE-2025-63800
Open Source Point of Sale version 3.4.1 is vulnerable to a weak password requirement flaw in its password change endpoint . Due to a lack of server-side validation , an authenticated user can omit or leave the password and repeat_password parameters empty. The backend processes these requests suc...
CVE-2025-63800
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the password and repeatpassword parameters empty in the password change request, the...
Malicious code in node-calculator-1b6e (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9836f0c7c84a6804c063c9e845dd05381413f1c6c9fe2b6d8e1d70473a80a456 The package node-calculator-1b6e was found to contain malicious code. Source: ossf-package-analysis...
Itsourcecode Web-Based Internet Laboratory SQL Injection Vulnerability
Web-Based Internet Laboratory Management System is a web laboratory software. The Web-Based Internet Laboratory Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the file /course/controller.php. An attacker...