CVE-2020-15390

pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo...

A Bootiful Podcast: V Körbes on security from the platform on up

Hi, Spring fans! In today's extra special installment I talk to Broadcom's V Körbes who works on security above and below the application...

CVE-2025-4311

creationtimestamp| type| source ---|---|--- 2025-05-06 04:20:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15044 2025-05-06 06:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loiajoerph2h 2025-05-06 07:00:55+00:00| published-proof-of-concept|...

CVE-2025-32973 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and...

CVE-2025-4036

creationtimestamp| type| source ---|---|--- 2025-04-28 20:11:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13726 2025-04-28 23:45:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnvx5vaqci2h 2025-04-29 00:06:28+00:00| seen|...

CVE-2024-12706

creationtimestamp| type| source ---|---|--- 2025-04-28 18:11:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13719 2025-04-28 21:45:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnvqh4moq42v 2025-04-28 22:25:59+00:00| seen| https://t.me/cvedetector/23940...

CVE-2025-2903

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform GCP using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious...

CVE-2025-3698

creationtimestamp| type| source ---|---|--- 2025-04-16 02:55:43+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11982 2025-04-16 06:48:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmvyq76czu2a 2025-04-16 07:40:00+00:00| seen| https://t.me/cvedetector/23044...

CVE-2025-31580

creationtimestamp| type| source ---|---|--- 2025-04-01 22:57:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llrxuf5ojr2s 2025-04-01 23:56:03+00:00| seen| https://t.me/cvedetector/21809...

The vulnerability of the org.xwiki.platform:xwiki-platform-security-authorization-api component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to gain unauthorized access to protected information.

The vulnerability of the org.xwiki.platform:xwiki-platform-security-authorization-api component of the XWiki Platform lies in the insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2025-29925

XWiki Platform REST API vulnerability CVE-2025-29925: the /rest/wikis/[wikiName]/pages endpoint could disclose information about protected/private pages to unauthenticated users before fixes. The issue occurs because the endpoint listed pages even when the user had no view rights, notably when th...

CVE-2025-26707

creationtimestamp| type| source ---|---|--- 2025-03-11 07:35:35+00:00| seen| https://t.me/cvedetector/20032 2025-03-11 08:00:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk3lxtq7qd2l...

GHSA-63CR-XG3F-8JVR Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

CVE-2025-1127

creationtimestamp| type| source ---|---|--- 2025-02-13 18:52:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113998086368947353 2025-02-13 19:16:11+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li3flzjmfv2a 2025-02-13 20:34:57+00:00| seen|...

CVE-2022-31166

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor...

CVE-2025-23681

creationtimestamp| type| source ---|---|--- 2025-01-22 15:19:59+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgdo5h3jiw2f...

CVE-2024-56604

creationtimestamp| type| source ---|---|--- 2024-12-27 15:18:02+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lecbvshtvv2f 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2026-03-19 00:00:00+00:00| seen|...

USN-7159-4: Linux kernel (IoT) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - S390 architecture; - x86 architecture; - Power management core; - GPU...

The vulnerability of the loader for AMD Platform Security Processor processors allows a hacker to execute arbitrary code.

The vulnerability of the loader for AMD Platform Security Processor processors involves incorrect checking of the range in the object header. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-55663 XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in getdocument.vm; the ordering of the returned documents is defined from an unsanitized request parameter request.sort and can allow any user to inject HQL. Depending on th...