GHSA-9WG9-93H9-J8CH Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1...

PT-2025-21781 · Unknown · Y Project Ruoyi

Name of the Vulnerable Software and Affected Versions: y project RuoYi version 4.8.0 Description: A vulnerability has been found in y project RuoYi. It affects an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the ids argument...

EulerOS Virtualization 2.12.1 : vim (EulerOS-SA-2025-1551)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window...

PT-2025-21771 · Unknown · Audio Comments Plugin

Name of the Vulnerable Software and Affected Versions: Audio Comments Plugin versions up to, and including, 1.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This allows...

PT-2025-21864 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 16.03.10.13 Description: A critical issue affects an unknown functionality of the file /goform/UserCongratulationsExec. The manipulation of the getuid argument leads to a buffer overflow. This issue can be exploited remotel...

PT-2025-21815 · D Link · D-Link Dcs-932L

Name of the Vulnerable Software and Affected Versions: D-Link DCS-932L version 2.18.01 Description: A critical vulnerability affects the function isUCPCameraNameChanged of the file /sbin/ucp. The manipulation of the argument CameraName leads to a stack-based buffer overflow. The attack can be...

KLA83717 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Out of bounds memory read or write vulnerability can be exploited to cause denial of service. 2. Out of bounds...

PT-2025-21811 · Mozilla +1 · Firefox +1

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Description: An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. Recommendations: For Firefox versions...

PT-2025-21810 · Mozilla +1 · Firefox +1

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Description: The issue allows an attacker to perform an out-of-bounds read or write on a JavaScript Promise object. Recommendations: For Firefox versions prior to 138.0....

PT-2025-21777

Name of the Vulnerable Software and Affected Versions: The Echo RSS Feed Post Generator plugin for WordPress versions up to, and including, 5.4.8.1 Description: The issue is related to arbitrary file uploads due to missing file type validation in the echo generate featured image function. This...

PT-2025-21780 · WordPress · Csv Mass Importer

Name of the Vulnerable Software and Affected Versions: CSV Mass Importer WordPress plugin versions 1.2 and earlier Description: The issue concerns the CSV Mass Importer WordPress plugin, which does not properly validate uploaded files. This allows high-privilege users, such as administrators, to...

EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2025-1546)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

PT-2025-21812 · Unknown · Kanwangzjm Funiture

Name of the Vulnerable Software and Affected Versions: kanwangzjm Funiture versions up to 71ca0fb0658b3d839d9e049ac36429207f05329b Description: A problematic issue was found in the doPost function of the LoginServlet.java file, affecting the Login component. The manipulation of the ret argument...

PT-2025-21802 · Donetick · Donetick

Name of the Vulnerable Software and Affected Versions: Donetick versions prior to 0.1.44 Description: The issue concerns the use of JSON Web Tokens JWT for authentication in Donetick, an open-source task management application. Prior to version 0.1.44, the application uses a weak default signing...

PT-2025-21786 · WordPress · Wise Chat

Name of the Vulnerable Software and Affected Versions: Wise Chat plugin for WordPress versions prior to 3.3.4 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain file attachments included in ch...

PT-2025-21769 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /pages/supplier update.php. The manipulation of the Name argument leads to SQL injection...

Spring Framework DataBinder Case Sensitive Match Exception

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: 6.2...

CVE-2025-22233

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: 6.2...

IBM Security Guardium stored cross-site scripting

RISK EVALUATION IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting XSS. An attacker with administrative privileges could store arbitrary content or script in the administrative web interface that would be rendered or executed by users visiting modified parts of the web...

CVE-2025-22233

The CVE-2025-22233 entry refers to a vulnerability in Spring Framework where Locale-dependent lowercase conversion still allows bypassing disallowedFields checks in data binding. Affected products/versions include Spring Framework 6.2.0–6.2.6, 6.1.0–6.1.19, 6.0.0–6.0.27, and 5.3.0–5.3.42 (older v...