CVE-2024-12251

In Progress® Telerik® UI for WinUI versions prior to 2025 Q1 3.0.0, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-12251

In Progress Telerik UI for WinUI versions prior to 2025 Q1 3.0.0, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-12251

CVE-2024-12251 affects Progress Telerik UI for WinUI prior to 2025 Q1 (3.0.0). The issue is a command injection vulnerability caused by improper neutralization of hyperlink elements. Impact is reported as high (CVSSv3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public exploit details are not provide...

CVE-2024-12251 Improper neutralization special element in hyperlinks

In Progress Telerik UI for WinUI versions prior to 2025 Q1 3.0.0, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-12251 Improper neutralization special element in hyperlinks

In Progress Telerik UI for WinUI versions prior to 2025 Q1 3.0.0, a command injection attack is possible through improper neutralization of hyperlink elements...

PT-2025-6516

Name of the Vulnerable Software and Affected Versions Progress Telerik UI for WinUI versions prior to 2025 Q1 3.0.0 Description A command injection attack is possible through improper neutralization of hyperlink elements. This issue allows for a command injection attack, potentially leading to...

PT-2025-6508 · Telerik · Kendo Ui

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Kendo UI for Vue versions v2.4.0 through v6.0.1 Description: The issue allows an attacker to introduce or modify properties within the global prototype chain, which can result in denial of service or command injection...

Progress Telerik UI 命令注入漏洞

Progress Telerik UI is a suite of UI user interface controls for application development from Progress, Inc. A command injection vulnerability exists in Progress Telerik UI prior to version 2025 Q1, which stems from a command injection attack that can be performed by incorrectly neutralizing...

Google Chrome < 133.0.6943.98 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 133.0.6943.98. It is, therefore, affected by multiple vulnerabilities as referenced in the 202502stable-channel-update-for-desktop12 advisory. - Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed...

PT-2025-6781 · Progress · In Progress Telerik Ui For Winforms

Name of the Vulnerable Software and Affected Versions: In Progress Telerik UI for WinForms versions prior to 2025 Q1 2025.1.211 Description: The issue is related to the improper limitation of a target path, which can lead to decompressing an archive's content into a restricted directory. This can...

Stable Channel Update for Desktop

The Stable channel has been updated to 133.0.6943.98/.99 for Windows, Mac and 133.0.6943.98 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept restrict...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Malicious code in vue-search-ui-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eba39e62ce67a90fdd330c95bec218d75c2ddbb0e16d24625081c96a115a046 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1266 Malicious code in vue-search-ui-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eba39e62ce67a90fdd330c95bec218d75c2ddbb0e16d24625081c96a115a046 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-57957

Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Apache Ranger Cross-Site Scripting Vulnerability (CNVD-2025-03540)

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation for implementing comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

CVE-2024-56472

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-24980

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version...

CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version...

CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version...