CVE-2025-0972 Zenvia Movidesk New Ticket cross site scripting

A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2024-50078 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50078 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

Amazon Linux 2 : git (ALAS-2025-2737)

The version of git installed on the remote host is prior to 2.47.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2737 advisory. Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level...

Important: tomcat9

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2025-23205 `frame-ancestors: self` grants all users access to formgrader in nbgrader

nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomai...

CVE-2024-56136

Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an emai...

CVE-2025-23031 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionaralergia.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

CVE-2025-23033

WeGIA has a Stored XSS in the adicionar_situacao.php endpoint affecting the situacao parameter. The flaw arises from insufficient input validation/sanitization, allowing malicious scripts to be stored on the server and executed when the affected page is loaded. The issue has been fixed in version...

CVE-2025-22616

CVE-2025-22616 affects WeGIA; a Stored XSS vulnerability exists in the dependente_parentesco_adicionar.php endpoint through the descricao parameter. The issue arises from insufficient input validation/sanitation, allowing malicious scripts to be stored on the server and executed in users’ browser...

GHSA-MJF9-4PCV-VFG7 Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

PT-2025-1849 · WordPress · Marketplace Items

Name of the Vulnerable Software and Affected Versions: Marketplace Items plugin for WordPress versions up to, and including, 1.5.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'marketplace' shortcode. This allow...

CVE-2024-56802

Tapir (private Terraform registry) exposed a vulnerability in versions 0.9.0 and 0.9.1 where scope-able Deploykeys could be guessed, granting write access to the registry. Root cause: deployment keys with insufficient entropy/validation allowed unauthorized write capabilities. Impact: potential u...

UBUNTU-CVE-2024-52046

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2024-54150

cjwt is a C JSON Web Token JWT Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to exploit the lack of distinction between signing methods. If the system doesn't differentiate between an HMAC signed token and an RS/EC/PS...

CVE-2024-56140

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-53270

Envoy proxy vulnerability CVE-2024-53270 affects affected releases where sendOverloadError may assume an active_request exists when envoy.load_shed_points.http1_server_abort_dispatch is configured. If active_request is nullptr, onMessageBeginImpl can return ok despite the stream being reset, caus...

CVE-2024-50379

Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from...

DoS (Denial of Service) ua-parser.js Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability, caused by ua-parserj.js, was introduced in versions 6.0.4 and 6.1.2 of Crowd Data Center. This DoS Denial of Service, with a CVSS Score of 7.5 and a CVSS vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, allows an unauthenticated...