AVideo security vulnerabilities

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. A security vulnerability exists in AVideo versions prior to 20.0, which stems from multiple public API endpoints leaking absolute filesystem paths, potentially exposing the underlying filesystem structure...

Open Source Point of Sale security vulnerabilities

Open Source Point of Sale is a web-based point of sale system. A security vulnerability exists in Open Source Point of Sale version 3.4.1, which stems from an unvalidated name parameter and could lead to a cross-site scripting attack...

Open Source Point of Sale Cross-Site Script Vulnerabilities

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site scripting vulnerability exists in Open Source Point of Sale versions 3.4.0 through prior to 3.4.2, which stems from a return policy configuration field that is not properly cleared of user...

Open OnDemand security vulnerabilities

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand 4.0.8 and earlier versions, which originates when the Apache proxy passes sensitive headers to the origin server, potentially leadin...

Open Source Point of Sale security vulnerabilities

Open Source Point of Sale is a web-based point of sale system. A security vulnerability exists in Open Source Point of Sale version 3.4.1, which stems from an unvalidated phonenumber parameter that could lead to a cross-site scripting attack...

CVE-2025-66923

A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...

CVE-2025-66924

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

CVE-2025-67895

creationtimestamp| type| source ---|---|--- 2025-12-16 15:13:17+00:00| seen| https://seclists.org/oss-sec/2025/q4/280 2025-12-17 13:42:16+00:00| seen| https://gist.github.com/Darkcrai86/3e68b0ba666c48a6963c4bbdca1c90c3 2025-12-17 15:12:00+00:00| seen|...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Java™, IBM® Semeru Runtime and Open-Source Software OSS components used by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary...

[SECURITY] Fedora 43 Update: chromium-143.0.7499.109-2.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

EUVD-2025-203487

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other...

EUVD-2025-203488

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

ABP security vulnerabilities

abp is an ABP open source web application framework. A security vulnerability exists in abp version 5.1.0 through versions prior to 10.0.0-rc.2, which stems from failure to properly validate the returnUrl parameter, which could result in a redirect to an arbitrary external domain...

Allsky Camera security vulnerabilities

Allsky Camera is an Allsky open source camera system for photographing and monitoring the entire sky. A security vulnerability exists in Allsky Camera version v2024.12.0606, which originates from path traversal and could lead to arbitrary command execution...

InvoicePlane security vulnerabilities

InvoicePlane is an application from InvoicePlane Open Source. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane suffers from a security vulnerability that stems from improper access control and could lead to invoice data leakag...

HAL -- an Open-Source Framework for Gate-Level Netlist Analysis

HAL is an open-source framework for gate-level netlist analysis, an integral step in hardware reverse engineering. It provides analysts with an interactive GUI, an extensible plugin system, and APIs in both C++ and Python for rapid prototyping and automation. In addition, HAL ships with plugins f...

GLPI security vulnerabilities

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Grassroot DICOM security vulnerabilities

Grassroot DICOM is a Sourceforge open source C++ library for DICOM medical files. A security vulnerability exists in Grassroot DICOM version 3.024, which stems from an out-of-bounds read in the Overlay function that could lead to information disclosure...

PimpMyLog security vulnerabilities

PimpMyLog is an open source log file viewer and analysis tool from Potsky, France. A security vulnerability exists in PimpMyLog version 1.7.14, which stems from improper access control and could allow a remote attacker to create an administrator account and inject malicious JavaScript...

Wave Terminal path traversal vulnerability

Wave Terminal is an enterprise collaboration system from the Wave Terminal open source. A path traversal vulnerability exists in Wave Terminal, which stems from a path traversal in the alog script that could result in reading or deleting files...