SUSE CVE-2024-6844

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...

PT-2025-12393 · Zoho · Manageengine Supportcenter Plus +1

Name of the Vulnerable Software and Affected Versions: ManageEngine ServiceDesk Plus versions below 14920 ManageEngine ServiceDesk Plus MSP versions below 14910 ManageEngine SupportCentre Plus versions below 14910 Description: The issue concerns a Stored XSS vulnerability in the task feature. Thi...

CVE-2024-50053: Improper Neutralization of Input During Web Page Generation

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature...

WordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Google Plus versions = 1.0.2...

DEBIAN-CVE-2024-6844

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...

UBUNTU-CVE-2024-6844

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...

Flask-CORS 安全漏洞

Flask-CORS is a cross-origin resource sharing component for Flask by the individual developer Cory Dolphin. A security vulnerability exists in Flask-CORS version 4.0.1, which stems from improper handling of the + character in the URL path, and could lead to inconsistent cross-domain resource...

CVE-2025-1724

Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token...

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

...

CVE-2025-1724

Affected products: Zohocorp’s ManageEngine Analytics Plus and Zoho Analytics on‑premise, versions older than 6130. Root cause: hardcoded sensitive token leading to an AD‑only account takeover. Impact: potential unauthorized AD account access; impact details are as described in the sources. Exploi...

Malicious code in skinport-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19fd08e816a49e9680bab750bc6a7a68bcba51614fe279028ec2b888fca365f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2474 Malicious code in skinport-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19fd08e816a49e9680bab750bc6a7a68bcba51614fe279028ec2b888fca365f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ZOHO ManageEngine Analytics Plus和ZOHO ManageEngine Analytics on-premise 安全漏洞

ZOHO ManageEngine Analytics Plus and ZOHO ManageEngine Analytics on-premise are both products of ZOHO, Inc. ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution. Get a better view of your IT data with rich visualizations and dashboards.ZOHO ManageEngine Analytics on-premise is...

CVE-2025-1724: Use of Hard-coded Credentials

Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token...

PT-2025-11454

Name of the Vulnerable Software and Affected Versions ManageEngine Analytics Plus versions prior to 6130 Zoho Analytics versions prior to 6130 Description The issue is related to an AD only account takeover due to a hardcoded sensitive token. This allows for unauthorized access. The estimated...

WordPress School Management System – WPSchoolPress plugin <= 2.2.16 - Authenticated (Parent+) SQL Injection vulnerability

Authenticated Parent+ SQL Injection vulnerability discovered by wesley wcraft in WordPress Plugin WPSchoolPress versions = 2.2.16...

USN-7328-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

WordPress Industrial theme <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Theme Industrial versions = 1.7.8...

USN-7344-2 linux-azure, linux-azure-4.15 vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2024-23848 Attila Szász discovered that the HFS+ file system...

USN-7328-2 linux-nvidia vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...