CVE-2024-11626

Progress Sitefinity CVE-2024-11626 is an XSS-type vulnerability due to improper input neutralization in the CMS backend page generation. It affects Sitefinity releases 4.0–14.4.8142, 15.0.8200–15.0.8229, 15.1.8300–15.1.8327, and 15.2.8400–15.2.8421. The CVE details are corroborated by NVD, Red Ha...

CVE-2024-11625

Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421...

PT-2025-4568 · Unknown · Biltorvet Dealer Tools

Name of the Vulnerable Software and Affected Versions: Biltorvet Dealer Tools versions 1.0.0 through 1.0.22 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. An information disclosure vulnerability exists in IBM Concert versions 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3, which stems from a detailed technical...

CVE-2024-11716

CVE-2024-11716 (CTFd) : A logic flaw in CTFd allows an authenticated user to reset their bracket after registration and join another team while a competition is ongoing. Affected releases: 3.7.0—3.7.4. The issue was addressed in 3.7.5 via pull request 2636. Practical impact: potentially enables b...

CVE-2024-37458

Cross-Site Request Forgery CSRF vulnerability in extendthemes Highlight highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a through = 1.0.29...

PT-2025-2484 · Desertthemes · Newsmash

Name of the Vulnerable Software and Affected Versions: DesertThemes NewsMash versions 1.0.0 through 1.0.34 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 1.0.0...

CHANGING CGFIDO 安全漏洞

CHANGING CGFIDO is a passwordless authentication system from China-based CHANGING. A security vulnerability exists in CHANGING CGFIDO versions 0.0.1 through 1.1.0, which originates from an authentication bypass vulnerability in the passwordless login mechanism that allows a remote attacker with...

PT-2024-17909 · Softiron · Softiron Hypercloud

Name of the Vulnerable Software and Affected Versions: SoftIron HyperCloud versions 2.3.0 through 2.4.x Description: An issue exists where authenticated, but non-admin users can create data pools, potentially impacting the performance and availability of the backend software-defined storage...

UBUNTU-CVE-2024-56732

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hbcairoglyphsfrombuffer function...

marp-core 跨站脚本漏洞

marp-core is a Marp open source core for a Marp converter. A cross-site scripting vulnerability exists in marp-core versions v3.0.2 through v3.9.0 and v4.0.0, which stems from improper neutralization of HTML cleanup and is vulnerable to cross-site scripting attacks...

Apache HugeGraph 安全漏洞

Apache HugeGraph is a fast and scalable graph database from the Apache USA Foundation. A security vulnerability exists in Apache HugeGraph version 1.0.0 through versions prior to 1.5.0, which stems from the presence of an assumed immutable data vulnerability that could allow an attacker to bypass...

PT-2025-1616 · WordPress · Updraftplus: Wp Backup & Migration Plugin

Name of the Vulnerable Software and Affected Versions: UpdraftPlus: WP Backup & Migration Plugin versions 1.23.8 through 1.24.11 Description: The UpdraftPlus: WP Backup & Migration Plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the recursive...

DEBIAN-CVE-2024-9101

A reflected cross-site scripting XSS vulnerability in the 'Entry Chooser' of phpLDAPadmin version 1.2.1 through the latest version, 1.2.6.7 allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' functio...

UBUNTU-CVE-2024-9102

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet...

phpLDAPadmin 安全漏洞

phpLDAPadmin is a web-based LDAP client from the phpLDAPadmin personal developer, which is primarily used to manage LDAP servers. A security vulnerability exists in phpLDAPadmin versions 1.2.1 through 1.2.6.7, which stems from the presence of a reflective cross-site scripting vulnerability that...

phpLDAPadmin 安全漏洞

phpLDAPadmin is a web-based LDAP client from the phpLDAPadmin Personal Developer, which is primarily used to manage LDAP servers. A security vulnerability exists in phpLDAPadmin versions 1.2.0 through 1.2.6.7. An attacker exploiting this vulnerability can cause CSV formula injection...

PT-2024-36618 · Trend Micro · Trend Micro Deep Security Agent

Name of the Vulnerable Software and Affected Versions: Trend Micro Deep Security Agent versions 20.0.1-9400 through 20.0.1-23340 Description: An incorrect permissions assignment issue could allow a local attacker to escalate privileges on affected installations. To exploit this issue, an attacker...

IBM Storage Defender 安全漏洞

IBM Storage Defender is a solution from International Business Machines IBM that provides end-to-end data resiliency. A security vulnerability exists in IBM Storage Defender versions 2.0.0 through 2.0.9, which stems from the presence of user credentials stored in plain text that can be read by an...

Apache Kafka 安全漏洞

Apache Kafka is an open source distributed streaming platform from the Apache USA Foundation. The platform is capable of fetching real-time data for building applications that react in real-time to changes in the data stream. A security vulnerability exists in Apache Kafka versions 0.10.2.0 throu...