CVE-2025-37732 Kibana Cross-site Scripting via the Integration Package Upload Functionality

Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 CVE-2025-25018 bypassing that fix to achieve HT...

CVE-2025-37732

CVE-2025-37732 is a Kibana Cross-site Scripting (XSS) vulnerability via the Integration Package Upload Functionality. The root cause is improper neutralization of input during web page generation (CWE-79). An authenticated user can cause HTML tags to be rendered in a user’s browser, leading to HT...

CVE-2025-37732 Kibana Cross-site Scripting via the Integration Package Upload Functionality

Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 CVE-2025-25018 bypassing that fix to achieve HT...

Kibana 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-28)

Kibana Cross-site Scripting via the Integration Package Upload Functionality ESA-2025-28 Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an authenticated user to render an HTML page within a user’s browser via the integration package upload...

PT-2025-51213

Name of the Vulnerable Software and Affected Versions versions prior to ESA-2025-17 Description An authenticated user can inject HTML tags into a user’s browser through the integration package upload functionality due to improper input neutralization during web page generation. This allows for...

CVE-2025-13428

CVE-2025-13428 affects the SecOps SOAR server. The vulnerability arises from weak validation of uploaded Python package code in custom integrations, allowing an authenticated user with an IDE role to achieve Remote Code Execution (RCE) via a malicious setup.py during installation. Impact is serve...

EUVD-2020-5558

Malware in sbrugna...

EUVD-2020-18952

Malware in sbrugna...

EUVD-2020-7512

Malware in sbrugna...

EUVD-2019-6683

Malware in sbrugna...

EUVD-2024-47660

Malicious code in bioql PyPI...

EUVD-2022-34783

Malicious code in bioql PyPI...

EUVD-2022-34350

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-13298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied...

CVE-2022-2528

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages...

CVE-2022-2049

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function...

CVE-2020-15525

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

CVE-2019-19084

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2025-31484: Improper Access Control

conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...

CVE-2020-26405

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are =12.8, =13.4, =13.5, 13.5.2...