PT-2025-4189 · Mattermost · Mattermost Mobile Apps

Name of the Vulnerable Software and Affected Versions: Mattermost Mobile Apps versions =2.22.0 Description: The issue arises from the failure to properly validate post properties, allowing a malicious authenticated user to cause a crash via a malicious post. This can be exploited by an...

CVE-2024-11736 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME or $PROPNAME. The serve...

CVE-2024-11736 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME or $PROPNAME. The serve...

CVE-2024-11736

CVE-2024-11736 (Keycloak) : The vulnerability arises when admins configure backchannel logout or admin URLs containing placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with environment variables/system properties during URL processing, potentially allowing a...

GHSA-F4V7-3MWW-9GC2 Keycloak allows unrestricted admin use of system and environment variables

A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME ...

org.keycloak:keycloak-quarkus-server: Unrestricted admin use of system and environment variables

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like $env.VARNAME or $PROPNAME. The serve...

PT-2025-1684

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A security issue allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin...

CVE-2024-56781

CVE-2024-56781 is listed in external advisories with concrete technical details about affected products and versions, despite the Initial Description stating the entry was rejected. Connected documents reference it as affecting Linux kernel versions older than specified builds (e.g., Linux kernel...

CVE-2024-56781 powerpc/prom_init: Fixup missing powermac #size-cells

In the Linux kernel, the following vulnerability has been resolved: powerpc/prominit: Fixup missing powermac size-cells On some powermacs escc nodes are missing size-cells properties, which is deprecated and now triggers a warning at boot since commit 045b14ca5c36 "of: WARN on deprecated...

CVE-2024-56410

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting XSS vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7...

GHSA-WV23-996V-Q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

Cross-Site Scripting XSS vulnerability in custom properties Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8...

PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

Cross-Site Scripting XSS vulnerability in custom properties Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8...

CVE-2024-56410 PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting XSS vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7...

CVE-2024-56410

PhpSpreadsheet has an XSS vulnerability in custom properties affecting the PhpSpreadsheet Writer Html path (class PhpOffice\PhpSpreadsheet\Writer\Html, generateMeta). Affected versions: < 3.7.0, < 2.3.5, < 2.1.6, and

CVE-2024-56410 PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting XSS vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7...

CVE-2024-56410 PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting XSS vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7...

Prototype Pollution

jsii is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of user input. When untrusted input is allowed to modify the prototype of objects, an attacker can inject malicious properties into the object's prototype, potentially altering the behavior of the entir...

Navidrome 安全漏洞

Navidrome is Navidrome Open Source a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device. A security vulnerability exists in Navidrome 0.53.3 and earlier versions, which stems from storing a JWT key in plaintext ...

PT-2024-10175 · Unknown · Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: PhpSpreadsheet versions prior to 3.7.0 PhpSpreadsheet versions prior to 2.3.5 PhpSpreadsheet versions prior to 2.1.6 PhpSpreadsheet versions prior to 1.29.7 Description: The issue is related to a cross-site scripting XSS vulnerability in cust...

Sensitive Information Exposure

zhmcclient is vulnerable to Sensitive Information Exposure. The vulnerability is due to the logging of password-like properties in clear text in both the zhmcclient API and HMC logs when specific functions for creating or updating configurations e.g., partitions, LPARs, image activation profiles,...