CVE-2025-58044 JumpServer has an Open Redirect Vulnerability

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This...

CVE-2025-61757: Imperva Customers Protected Against Critical Oracle Identity Manager Authentication Bypass Leading to Remote Code Execution

At the end of October 2025, Oracle released an emergency security alert addressing CVE-2025-61757, a high-severity authentication-bypass flaw that enables remote code execution in the Identity Manager product of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. Multiple threat actors a...

CVE-2025-10101

CVE-2025-10101 describes a heap-based buffer overflow and out-of-bounds write in Avast Antivirus for macOS triggered by a crafted Mach-O file, potentially enabling local code execution or denial of service. Affected versions are Avast Antivirus 15.7 up to 3.9.2025. Root cause: memory management f...

CVE-2025-63529

A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier prior to authentication. When the victim logs in, the application continues to use the attacker-supplied session ID rather than generating...

firefox: thunderbird: Spoofing issue in Firefox

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in Firefox...

EUVD-2025-199996

A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier prior to authentication. When the victim logs in, the application continues to use the attacker-supplied session ID rather than generating...

Fluent Bit < 4.0.12 / 4.1.x < 4.1.1 Multiple Vulnerabilities

The version of Fluent Bit running on the remote host is prior to 4.0.12, or 4.1.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities, including: - Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or...

CVE-2025-63529

Summary: CVE-2025-63529 describes a session fixation vulnerability in Blood Bank Management System 1.0, specifically in login.php, where an attacker can set or predict a user’s session ID before authentication. When the victim logs in, the app continues to use the attacker-supplied session ID, en...

PT-2025-48572

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 6.2.0 and earlier Description ChurchCRM is an open-source church management system. A time-based blind SQL injection exists in how the 1FieldSec parameter is handled. Injecting SLEEP results in predictable server-side delays...

The vulnerability of the AuthN component in the distributed storage system for NVIDIA AIStore-based AI applications allows a perpetrator to enhance their privileges and gain unauthorized access to protected information.

The vulnerability of the AuthN component in the NVIDIA AIStore distributed storage system for AI-based applications relates to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain unauthorized access to protected...

CVE-2025-53900 Kiteworks MFT has a Privilege Defined With Unsafe Actions

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0...

OpenPrinting CUPS 资源管理错误漏洞

OpenPrinting CUPS is a standards-based open source printing system for Linux® and other Unix®-like operating systems from OpenPrinting, Inc. A resource management error vulnerability exists in OpenPrinting CUPS versions prior to 2.4.15, which stems from a client sending a slow message that could...

AIS-catcher 数字错误漏洞

AIS-catcher is an AIS receiver from Jasper Personal Developers. A numeric error vulnerability exists in AIS-catcher versions prior to 0.64, which stems from an integer overflow in the MQTT parsing logic that could lead to a denial of service and memory corruption...

PT-2025-48364

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...

CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem...

CVE-2025-66372

Mustangproject

EUVD-2025-199851

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-3243...

burp_mirror_gui

Burp Multiple Instance Management Tool This solution, when combined with jsforward or mitmdump, effectively addresses the following pain points in penetration testing: 1. Enables real-time testing for privilege escalation, unauthorized access, business logic vulnerabilities, and session-related...

CVE-2025-60917

A reflected cross-site scripting XSS vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter...