CVE-2025-1908

GitLab CVE-2025-1908 affects GitLab EE/CE. The issue could allow an attacker to track users’ browsing activities, potentially enabling full account takeover. Affected versions are 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1. Root-cause details and remediation/fix informatio...

CVE-2025-1908 Business Logic Errors in GitLab

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

CVE-2025-1908: Undefined Security Weakness

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

GitLab 16.6 < 17.9.7 / 17.10 < 17.10.5 / 17.11 < 17.11.1 (CVE-2025-1908)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before...

Shopify faces privacy lawsuit for collecting customer data

Shopify faces a data privacy class action lawsuit in the US that could change the way globally active companies can be held accountable. The proposed class action is a revival of a case that had been dismissed by a lower court judge and a three-judge 9th Circuit Court of Appeals panel. But now it...

Android Spyware Disguised as Alpine Quest App Targets Russian Military Devices

Cybersecurity researchers have revealed that Russian military personnel are the target of a new malicious campaign that distributes Android spyware under the guise of the Alpine Quest mapping software. "The attackers hide this trojan inside modified Alpine Quest mapping software and distribute it...

Google Drops Cookie Prompt in Chrome, Adds IP Protection to Incognito

Google on Tuesday revealed that it will no longer offer a standalone prompt for third-party cookies in its Chrome browser as part of its Privacy Sandbox initiative. "We've made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be...

PT-2025-17706 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.6 through 17.9.7 GitLab EE/CE versions 17.10 through 17.10.5 GitLab EE/CE versions 17.11 through 17.11.1 Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing...

CVE-2025-43949

creationtimestamp| type| source ---|---|--- 2025-04-22 21:09:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lngln2jn4f2d 2025-04-22 22:35:24+00:00| seen| https://t.me/cvedetector/23547 2025-04-23 15:48:35+00:00| seen|...

CVE-2025-46243

creationtimestamp| type| source ---|---|--- 2025-04-22 10:03:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12824 2025-04-22 11:05:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnfju6kgeq2c 2025-04-22 14:13:30+00:00| seen|...

[SECURITY] Fedora 40 Update: uv-0.6.14-3.fc40

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

CVE-2025-40364

creationtimestamp| type| source ---|---|--- 2025-04-18 13:58:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12426 2025-04-18 14:23:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114359414511438148 2025-04-18 14:27:11+00:00| seen|...

CVE-2025-29453

creationtimestamp| type| source ---|---|--- 2025-04-17 21:58:23+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12365 2025-04-17 22:53:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ln274q7dzc2l 2025-04-18 03:12:18+00:00| seen| https://t.me/cvedetector/23300...

Care what you share

Welcome to this week's edition of the Threat Source newsletter. As we navigate our daily routines, certain tasks become second nature to us, especially if they are integral to our professions. However, what feels instinctive to one person might be foreign to another. This disparity is akin to a...

CVE-2025-27293

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through = 1.0...

CVE-2025-27293 WordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through = 1.0...

CVE-2025-27293

The CVE-2025-27293 entry concerns the WordPress plugin Shipmozo Courier Tracking (Shipmozo Courier Tracking). The vulnerability is an improper input neutralization that enables a Reflected Cross-Site Scripting (XSS) attack in the plugin, affecting versions from n/a up to 1.0. The CVSS vector is C...

CVE-2025-27293 WordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through = 1.0...

SUSE CVE-2024-58092

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4legacytrackingops-init call in checkforlegacymethods. That will be handled in the caller nfsd4clienttrackinginit. Otherwise, we'll wind up calling...

CVE-2025-27293: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through = 1.0...