13120 matches found
CVE-2025-47787 Emlog Pro Contains a File Upload Vulnerability
Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...
GHSA-FPFF-WJ6M-GRVR Mattermost Fails to Check User Access to `ExperimentalSettings`
Mattermost versions 10.5.x = 10.5.2, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...
CGA-HJ9P-RHP3-HF4P
Bulletin has no description...
GHSA-R7R2-M3VR-C8QC Mattermost Fails to Validate Team Invite Permissions
Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team...
BELL-CVE-2025-20623
Bulletin has no description...
BELL-CVE-2024-43420
Bulletin has no description...
MAL-2025-3856 Malicious code in spl-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e0efcb779c43be336174a24f04614ab82be9f92a235feaf6e344d814bb2789 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3948 Malicious code in developer-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 13d76633d0e28457718da249adad23171e53973864ef3e53406c78ced005d3af The OpenSSF Package Analysis project identified 'developer-bridge' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...
Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation
Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks...
Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
Jenkins Health Advisor by CloudBees Plugin 374.v194bd4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses...
K000151329: MySQL vulnerabilities CVE-2025-30704, CVE-2025-30705, and CVE-2025-30706
Security Advisory Description CVE-2025-30704 Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker wit...
CGA-QX79-6CVC-H6VF
Bulletin has no description...
CGA-PJJX-246H-5XF6
Bulletin has no description...
CVE-2025-24021 iTop doesn't have mass assignment of fields in the portal form
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...
RHSA-2025:7502 Red Hat Security Advisory: nodejs22 security update
Bulletin has no description...
RHSA-2025:7490 Red Hat Security Advisory: mod_auth_openidc security update
Bulletin has no description...
RHSA-2025:7489 Red Hat Security Advisory: php security update
Bulletin has no description...
RHSA-2025:7438 Red Hat Security Advisory: redis security update
Bulletin has no description...