CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

When using an Oracle DB, application properties can't be set to empty

h3. Issue Summary The jira.security.csp.sandbox.included.content.disposition application property accepts: Empty value "attachment" "inline" "attachment;inline" or "inline;attachment" If Jira is installed using an Oracle database, the empty value is never set. This happens because Oracle treats...

Property reflection in System.Linq.Dynamic.Core

An issue in System.Linq.Dynamic.Core versions before v.1.6.0 allow remote access to properties on reflection types and static properties/fields...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to improper handling of property access on reflection types and static properties/fields. An attacker can list installed nuget packages' names and versions through attributes and base types they require by...

CVE-2024-51417

An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields...

CVE-2024-51417

CVE-2024-51417 affects System.Linq.Dynamic.Core prior to 1.6.0. It allows remote access to properties on reflection types and static properties/fields. Affects versions before 1.6.0; remediation is to upgrade to version 1.6.0 or later. Connected sources confirm Red Hat, Veracode, GitHub advisorie...

PT-2025-2899 · Unknown · System.Linq.Dynamic.Core

Name of the Vulnerable Software and Affected Versions: System.Linq.Dynamic.Core versions prior to 1.6.0 Description: An issue in System.Linq.Dynamic.Core allows remote access to properties on reflection types and static properties/fields. Recommendations: For versions prior to 1.6.0, update to...

System.Linq.Dynamic.Core 安全漏洞

System.Linq.Dynamic.Core is a .NET Core/Standard port of the Microsoft assembly for .NET 4.0 Dynamic Language Features open-sourced by ZZZ Projects. A security vulnerability exists in System.Linq.Dynamic.Core version 1.4.6, which stems from a vulnerability that allows remote access to properties ...

WordPress plugin Estatebud – Properties & Listings 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2025-5252 · Unknown · Estatebud – Properties & Listings

Name of the Vulnerable Software and Affected Versions: Estatebud – Properties & Listings versions n/a through 5.5.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

CVE-2024-51417

An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields...

WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability

CSRF to Settings Update & Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Estatebud – Properties & Listings versions = 5.5.0...

GO-2025-3394 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GHSA-45V9-W9FH-33J6 Mattermost fails to properly validate post props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

Mattermost fails to properly validate post props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20086 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-21083 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

Keycloak 26.0.8 Multiple Vulnerabilities (26_0_8)

The version of Keycloak installed on the remote host is prior to 26.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 2608 advisory. - A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps that stems from a failure to properly validate post props, which can be exploited by an attacker to cause the application to crash...