[SECURITY] Fedora 40 Update: rpki-client-9.5-1.fc40

The OpenBSD rpki-client is a free, easy-to-use implementation of the Resource Public Key Infrastructure RPKI for Relying Parties RP to facilitate validation of the Route Origin of a BGP announcement. The program queries the RPKI repository system, downloads and validates Route Origin Authorisatio...

Metasploit Wrap-Up 04/18/2025

Smaller Fetch Payloads This week, a significant enhancement was made to the already awesome fetch payload feature by our very own bwatters-r7. The improvement introduces a new option, PIPEFETCH, which optimizes the process by serving both the payload and the command to be executed simultaneously...

Denial Of Service (DoS)

github.com/bep/imagemeta is vulnerable to Denial Of Service DoS. The vulnerability is due to untrusted input handling, which allows excessively large data structures to be defined in small payloads...

Threat actors misuse Node.js to deliver malware and other malicious payloads

Since October 2024, Microsoft Defender Experts DEX has observed and helped multiple customers address campaigns leveraging Node.js to deliver malware and other payloads that ultimately lead to information theft and data exfiltration. While traditional scripting languages like Python, PHP, and...

Cross-Site Scripting (XSS)

react-draft-wysiwyg is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization or escaping of user-provided data in the Embedded button functionality, allowing malicious payloads to be executed when the data is saved in the tag...

Cross-site Scripting (XSS)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTML editor. An attacker can inject malicious scripts by sending a specifically crafted encoded payload that bypasses...

UBUNTU-CVE-2025-1677

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

CVE-2025-1677 Allocation of Resources Without Limits or Throttling in GitLab

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

CVE-2025-1677

CVE-2025-1677 is a DoS in GitLab CE/EE causing denial of service when oversized payloads are injected into CI pipeline exports. Affected versions: all up to 17.8.7, 17.9 prior to 17.9.6, and 17.10 prior to 17.10.4. Remediation: upgrade to GitLab 17.9.6 or 17.10.4 or later (per provided details). ...

CVE-2025-1677 Allocation of Resources Without Limits or Throttling in GitLab

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

Prototype Pollution

Redoc is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of user-supplied input in the Module.mergeObjects component, allows attackers to manipulate the prototype chain and introduce malicious payloads, which can trigger a Denial of Service DoS...

Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings

Threat actors have been observed distributing malicious payloads such as cryptocurrency miner and clipper malware via SourceForge, a popular software hosting service, under the guise of cracked versions of legitimate applications like Microsoft Office. "One such project, officepackage, on the mai...

CVE-2024-46494

A cross-site scripting XSS vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article...

Exploit for CVE-2025-2783

CVE-2025-2783 Simulated PoC for CVE-2025-2783 — a sandbox esca...

CVE-2024-47212

An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt...

CVE-2025-30090

mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true...

PT-2025-14807 · Snowplow · Snowplow Collector

Name of the Vulnerable Software and Affected Versions: Snowplow Collector versions 3.x before 3.3.0 Description: The issue involves sending very large payloads to the Collector, which can render it unresponsive to other requests, potentially leading to data loss. Recommendations: For Snowplow...

CVE-2024-56528

This vulnerability affects Snowplow Collector 3.x before 3.3.0 unless it’s set up behind a reverse proxy that establishes payload limits. It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the...

CVE-2024-56528

This vulnerability affects Snowplow Collector 3.x before 3.3.0 unless it’s set up behind a reverse proxy that establishes payload limits. It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the...

CVE-2024-56528

The CVE-2024-56528 entry affects Snowplow Collector 3.x prior to 3.3.0. The root cause is handling of oversized payloads, which can render the Collector unresponsive to other requests and cause data to be blocked or lost in the pipeline. Affected component: Snowplow Collector (3.x). The impact is...