Amazon Linux 2 : rsync (ALAS-2025-2730)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2730 advisory. Placeholder CVE. Details forthcoming CVE-2024-12085 Placeholder CVE. Details forthcoming CVE-2024-12086 Placeholder CVE...

CVE-2024-13298

CVE-2024-13298 affects the Drupal Tarte au Citron module. The issue is improper neutralization of input during web page generation, enabling Cross‑Site Scripting (XSS). Affected: Tarte au Citron module versions 2.0.0 before 2.0.5. The problem arises in the module’s handling of input that can be i...

CVE-2024-13252 TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal TacJS allows Cross-Site Scripting XSS.This issue affects TacJS: from 0.0.0 before 6.5.0...

Mattermost has Improper Check for Unusual or Exceptional Conditions

Mattermost versions 10.x = 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting...

CVE-2025-22449

Mattermost Server 9.11.x ≤ 9.11.5 suffers an improper access-control flaw where team admins lacking invite permission can add users by toggling the allow_open_invite flag when a team is made public. Root cause: failure to enforce invite permissions. Affected feature/file: invite mechanism via all...

LangChain < 0.1.35 XXE

The version of LangChain installed on the remote host is prior to 0.1.35. It is, therefore, affected by a XML External Entity XXE vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers o...

CVE-2024-12302 Icegram Engage < 3.1.32 - Author+ Stored XSS

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-56224

CVE-2024-56224 is a Stored XSS in the Ledenbeheer WordPress plugin (vulnerable from n/a to 2.1.0) due to improper neutralization of input during page generation. The connected sources confirm the cross-site scripting vulnerability and affected range; no patch/version details are provided in the d...

Couchbase 6.x < 7.2.5 / 7.6.x < 7.6.1 Information Disclosure

The version of Couchbase installed on the remote host is 6.x, prior to 7.2.5, and 7.6.x prior to 7.6.1. It is, therefore, affected by an information disclosure issue. It does not ensure that credentials are negotiated with the Key-Value KV service using SCRAM-SHA when remote link encryption is...

CVE-2024-10244

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6...

BIT-GITLAB-2024-12292 Insertion of Sensitive Information into Log File in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...

CVE-2024-54336 WordPress Projectopia plugin <= 5.1.7 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia projectopia-core allows Authentication Bypass.This issue affects Projectopia: from n/a through = 5.1.7...

CVE-2024-54264

CVE-2024-54264 affects the WordPress Shortcodes Blocks Creator Ultimate plugin (versions through 2.2.0). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Exploitation is possible via standard web requests and may...

CVE-2024-50019 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50019 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-55546 Stored Cross-Site Scripting

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...

CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

Fortinet FortiWeb Uncontrolled resource consumption (FG-IR-21-039)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-039 advisory. - A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows...

Fortinet Fortigate fails to block malformed HTTP/S traffic when transparent proxy is enabled (FG-IR-20-172)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-172 advisory. - When traffic other than HTTP/S eg: SSH traffic, etc... traverses the FortiGate in version below 6.2.5 and below 6.4.2 on po...

Medium: python3.9

Issue Overview: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "certstorestats" and "getcacerts". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContex...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the HTML title attribute in the list view. An attacker can manipulate the output and inject malicious scripts by crafting malicious input that is improperly escaped. Note Patched version 3.1.3 has a...