PT-2025-28016 · Mediawiki · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - SecurePoll extension versions 1.39.X through 1.39.12 Mediawiki - SecurePoll extension versions 1.42.X through 1.42.6 Mediawiki - SecurePoll extension versions 1.43.X through 1.43.1 Description: The issue affects the Mediawiki -...

Security Bulletin:Unclear documentation of the error behavior in `ParseWithClaims` affects watsonx.data

Summary golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

CVE-2025-52553

CVE-2025-52553 affects authentik (open-source identity provider). The vulnerability arises from a session-specific, single-use token generated after authorizing access to a RAC endpoint that is embedded in the URL; the check ensuring the token is valid only for the originating user’s session is m...

PT-2025-27179 · Unknown · Opicron Image Cleanup

Name of the Vulnerable Software and Affected Versions: opicron Image Cleanup versions 1.9.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the opicron Image Cleanup, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For opicron Image...

PT-2025-28303 · Npm · Taylored

Hi team, I was looking at the recent fix and you limited the exploitability of race conditions but unfortunately it is still possible to exploit the issue since two requests happening at the exact same time will still go through. You should be able to completely fix the race conditions by...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

SUSE CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

UBUNTU-CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822

CVE-2024-38822 concerns Salt (Salt Master/Minion interaction): multiple methods in the Salt master skip minion token validation, enabling a misbehaving minion to impersonate another. Evidence from connected advisories shows patches fixing Minion token validation and related Salt issues (e.g., SUS...

CVE-2024-38822 CVE-2024-38822 Salt Advisory

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822 CVE-2024-38822 Salt Advisory

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

PT-2025-25386 · Salt +1 · Salt +1

Name of the Vulnerable Software and Affected Versions: Salt affected versions not specified Description: The issue allows a misbehaving minion to impersonate another minion due to the salt master skipping minion token validation in multiple methods. Recommendations: At the moment, there is no...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from multiple methods of skipping minion token validation, which could lead to a malicious minion impersonating...

PT-2025-24191 · Cubewp · Cubewp

Name of the Vulnerable Software and Affected Versions: CubeWP – All-in-One Dynamic Content Framework versions 1.1.23 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For CubeWP – All-in-One Dynamic...

PT-2025-24262 · Unknown · Atelier Create Cv

Name of the Vulnerable Software and Affected Versions: Atelier Create CV versions 1.1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on the...

Mattermost fails to properly invalidate personal access tokens upon user deactivation

Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...

CVE-2025-3230 Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...

CVE-2024-52528

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2...