GHSA-XWGX-8V72-4J5J Magento Stored Cross-Site Scripting (XSS) Vulnerability

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

Magento Stored Cross-Site Scripting (XSS) Vulnerability

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

Magento Information Exposure vulnerability

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue...

BELL-CVE-2024-57950

Bulletin has no description...

BELL-CVE-2025-21689

Bulletin has no description...

CVE-2024-55408

An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied...

PT-2025-6265 · Fortinet · Forticlientmac

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientMac versions 7.0.11 through 7.2.4 Description: The issue is related to improper authentication, allowing an attacker to gain unauthorized access to MacOS via an empty password. This is due to deficiencies in the...

PT-2025-6219

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.12.2 Description The issue concerns a DOM-based cross-site scripting XSS condition in the Code Inspection Report tab. This occurs due to insufficient protection of the web page structure. Exploitation...

CVE-2024-57950

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize denominator defaults to 1 WHAT & HOW Variables, used as denominators and maybe not assigned to other values, should be initialized to non-zero to avoid DIVIDEBYZERO, as reported by Coverity. cherry...

CVE-2025-21686

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: require cloned buffers to share accounting contexts When IORINGREGISTERCLONEBUFFERS is used to clone buffers from uring instance A to uring instance B, where A and B use different MMs for accounting, the accounting...

CVE-2025-25247 Apache Felix Webconsole: XSS in services console

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issu...

MAL-2025-1267 Malicious code in internallib_v789 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ef96477214541474a78705d81d93f2cee8bfdff72d03bc45f30c6431bacfb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OSV-2025-108 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=395207096 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

CVE-2021-41527

An error related to the 2-factor authorization 2FA on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA. The vulnerability requires that the 2FA setup hasn’t been completed...

CVE-2025-25078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through = 1.0...

CVE-2025-25146

Cross-Site Request Forgery CSRF vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through = 0.9.7...

CVE-2025-25076

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through = 0.2.2...

CVE-2025-25145

Cross-Site Request Forgery CSRF vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through = 2.0...

CVE-2025-25082

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through = 2.1.2...

CVE-2025-25136

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through = 1.0.3...