CVE-2025-24647

CVE-2025-24647 is a CSRF vulnerability in the WordPress plugin WooCommerce Cloak Affiliate Links (versions 1.0.35 and earlier). The issue allows Cross Site Request Forgery. CVSS v3.1 metrics (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) yield a base score of 5.4 (Medium). All connected sources identify t...

CVE-2025-0314 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting...

CVE-2025-23369

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This...

CVE-2025-20621

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...

Google Chrome Security Update (stable-channel-update-for-desktop_14-2025-01) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2025-23081

CVE-2025-23081 describes a CSRF and XSS vulnerability in the Wikimedia Foundation MediaWiki DataTransfer Extension caused by improper neutralization of input during web page generation. Affected versions are MediaWiki DataTransfer Extension 1.39.X before 1.39.11, 1.41.X before 1.41.3, and 1.42.X ...

CVE-2025-23078

This CVE affects the MediaWiki Breadcrumbs2 extension. Vulnerability: Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Impact is limited to the affected extension versions and could enable script execution in a victim’s browser. Affected versions are ...

CVE-2024-13274

Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5...

CVE-2025-22151

Strawberry GraphQL has a type confusion vulnerability in its relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). From version 0.182.0 up to, but not including, 0.257.0, the global node field may resolve to a different type mapped to the same model, causing inf...

GitLab 15.7 < 17.5.5 / 17.6 < 17.6.3 / 17.7 < 17.7.1 (CVE-2024-6324)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Inefficient Algorithmic Complexity in GitLab CVE-2024-6324 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CVE-2024-11627

: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421...

CVE-2024-56042

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through 1.9.9.5.3...

Keycloak 25.0.x < 26.0.6 Information Disclosure (GHSA-6mpx-pmgp-ww49)

Keycloak versions installed prior to 26.0.6 are affected by an information disclosure vulnerability as referenced in the advisory. - A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in...

CVE-2024-56047

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through 1.9.9.5.3...

Apache Tomcat Multiple Vulnerabilities (Dec 2024) - Linux

Apache Tomcat is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; if descriptio...

CVE-2024-54083

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side webapp and mobile DoS to users of particular channels, by sending a specially crafted post...

CVE-2024-54301 WordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS.This issue affects FormFacade: from n/a through = 1.3.6...

CVE-2024-52065

The connected PT-2024-35116 entry confirms a buffer copy without checking input size (classic buffer overflow) in RTI Connext Professional on non-Windows systems using the Persistence Service, exploitable via environment variables. Affected versions: 5.3.1.40–5.3.1.41, 6.1.1.2–6.1.2.21, and 7.0.0...

CVE-2024-10043 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

GitLab 11.8 < 17.4.6 / 17.5 < 17.5.4 / 17.6 < 17.6.2 (CVE-2024-9387)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - URL Redirection to Untrusted Site 'Open Redirect' in GitLab CVE-2024-9387 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...