304 matches found
CVE-2025-31213
Summary: CVE-2025-31213 describes a logging issue that could reveal associated usernames and websites from a user’s iCloud Keychain. Apple fixed the flaw in multiple Apple OS updates: iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, and macOS Sonoma 14.7.6. Affected software: Apple's iPad...
CVE-2025-43854
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...
CVE-2025-43854 DIFY vulnerable to Clickjacking Attack
DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...
CVE-2025-46544
CVE-2025-46544 affects Sherpa Orchestrator 141851. A low-privileged user can elevate privileges by creating new users and roles, as documented by multiple sources in connected documents. The vulnerability description is consistent across feeds; no exploits are provided in the documents. Some advi...
CVE-2025-24315
Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...
CVE-2025-32789
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...
CVE-2025-27561
Unauthenticated attackers can rename "rooms" of arbitrary users...
Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-920)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-920 advisory. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum...
PT-2025-13383 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A stored Cross-Site Scripting XSS issue was identified, allowing unauthorized scripts to be executed within the user's browser context. This type of XSS is particularly critical because the malicious...
CVE-2025-27404
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...
CVE-2025-24053 Microsoft Dataverse Elevation of Privilege Vulnerability
...
BIT-GITLAB-2024-10925 Authorization Bypass Through User-Controlled Key in GitLab
A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML...
CVE-2024-10925 Authorization Bypass Through User-Controlled Key in GitLab
A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML...
CVE-2025-27408
Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt,...
CVE-2025-26326
A vulnerability was identified in the NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered ...
Craft CMS Code Injection Vulnerability
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...
JVN#48742353: Multiple cross-site scripting vulnerabilities in Movable Type
Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score 5.4 CVE-2025-22888 Stored cross-si...
CVE-2025-24036 Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
...
CVE-2025-24973
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...
