CVE-2025-0290 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive...

CVE-2024-22315

IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection...

CVE-2025-23656

CVE-2025-23656 describes a Missing Authorization vulnerability in the WordPress plugin Donate visa (Saul Morales Pacheco) that allows Stored Cross-Site Scripting (XSS) in versions n/a through 1.0.0. The vulnerability arises from missing authorization controls, enabling an attacker to inject and p...

PT-2025-1442 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.0 through 2.3.3.7 iFix1 Description: The issue is related to deficiencies in the error reporting mechanism of IBM Cloud Pak System, which could allow a remote attacker to gain unauthorized access to protect...

PT-2025-1439 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.4.0 Description: The issue is related to incorrect restriction of a directory path name with limited access. Exploitation of this issue may allow a remote attacker to disclose protected...

PT-2025-1444 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.4.0 Description: The issue is related to shortcomings in the error reporting mechanism of IBM Cloud Pak System, which could allow a remote attacker to gain unauthorized access to protected...

CVE-2025-23838 WordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected XSS.This issue affects Bauernregeln: from n/a through = 1.0.1...

PT-2025-5396 · Unknown · Rstheme Ultimate Coming Soon & Maintenance

Name of the Vulnerable Software and Affected Versions: RSTheme Ultimate Coming Soon & Maintenance versions 1.0.0 through 1.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.0.0 through 1.0.9,...

CVE-2025-23636

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflected XSS.This issue affects My Favorite Car: from n/a through = 1.0...

CVE-2023-50309

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

IBM Sterling B2B Integrator 跨站脚本漏洞

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions, and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Security Verify Bridge 安全漏洞

IBM Security Verify Bridge is an IBM application component from International Business Machines IBM, Inc. provides IBM Cloud access to user attributes and authentication that are controlled by the client's local LDAP or Active Directory. A security vulnerability exists in IBM Security Verify Brid...

CVE-2025-23475

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through = 0.7.2...

atlassian-bitbucket-server-integration allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. atlassian-bitbucket-server-integration implements this extension point to support OAuth 1.0 authentication. In atlassian-bitbucket-server-integration 2.1.0 through 4.1.3 both...

CVE-2025-22262

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This issue affects Bonjour Bar: from n/a through = 1.0.0...

Brave Browser 输入验证错误漏洞

Brave Browser is a fast, private and secure web browser for PC, Mac and mobile devices from Brave, Inc. An input validation error vulnerability exists in Brave Browser versions 1.70.x through 1.73.x. The vulnerability stems from the source of a site not being correctly identified in the file...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite is a set of fully integrated global business management software from Oracle USA. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business Suite versions 12.2....

CVE-2025-23677

Cross-Site Request Forgery CSRF vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through = 0.2.4...

CVE-2025-23456

Cross-Site Request Forgery CSRF vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through = 2.2.1...

CVE-2025-23533

CVE-2025-23533 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Lyrics that enables a Stored XSS . The Red Hat entry and related records describe the issue as affecting WP Lyrics: from n/a through 0.4.1 . The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L ,...