CVE-2025-23208

The CVE-2025-23208 issue affects Zot, an OCI image registry. Root cause: SetUserGroups on login appends new groups instead of replacing existing memberships, stored in boltdb (meta.db), so group revocations/removals from IdPs are ignored. Impact: any configuration using group-based authorization ...

CVE-2025-23208 IdP group membership revocation ignored in zot

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

CVE-2025-23208 IdP group membership revocation ignored in zot

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

CVE-2024-13286 SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SVG Embed allows Cross-Site Scripting XSS.This issue affects SVG Embed: from 0.0.0 before 2.1.2...

CVE-2024-13286 SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SVG Embed allows Cross-Site Scripting XSS.This issue affects SVG Embed: from 0.0.0 before 2.1.2...

SUSE CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620 Deno's authorization headers not dropped when redirecting cross-origin

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

PT-2025-4305 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 2.1.2 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When a request with the Authorization header is sent to one domain and the response asks to redirect to a different...

CVE-2024-38729

Cross-Site Request Forgery CSRF vulnerability in mbeelink MBE eShip mail-boxes-etc allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through = 2.1.2...

CVE-2024-37238

Cross-Site Request Forgery CSRF vulnerability in Greg Winiarski WPAdverts wpadverts allows Cross Site Request Forgery.This issue affects WPAdverts: from n/a through = 2.1.2...

CVE-2024-38729 WordPress MBE eShip plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in mbeelink MBE eShip mail-boxes-etc allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through = 2.1.2...

CVE-2024-37238

CVE-2024-37238 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WPAdverts – Classifieds Plugin by Greg Winiarski. Affected versions are listed as from n/a through

PT-2025-1522 · Unknown · Revenuehunt Product Recommendation Quiz For Ecommerce

Name of the Vulnerable Software and Affected Versions: RevenueHunt Product Recommendation Quiz for eCommerce versions 2.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

WordPress plugin WPAdverts 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress plugin Product Recommendation Quiz for eCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...

WordPress ForumWP plugin <= 2.1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin ForumWP versions = 2.1.2...

VaeMendis Ubooquity 信息泄露漏洞

VaeMendis Ubooquity is a free, lightweight and easy-to-use home server from VaeMendis. An information disclosure vulnerability exists in VaeMendis Ubooquity version 2.1.2 that originates from exposing sensitive information to unauthorized actors...

VaeMendis Ubooquity 跨站请求伪造漏洞

VaeMendis Ubooquity is a free, lightweight and easy-to-use home server from VaeMendis. A cross-site request forgery vulnerability exists in VaeMendis Ubooquity version 2.1.2, which stems from the inclusion of a cross-site request forgery issue...

WordPress WP Hotel Booking plugin <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Truoc Phan in WordPress Plugin WP Hotel Booking versions = 2.1.2...