CVE-2025-64488 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious callid that alters the logic of the SQL query or injects arbitrary SQL. An attack can...

CVE-2025-64103

CVE-2025-64103 concerns Zitadel where, starting from versions 2.53.6, 2.54.3, and 2.55.0, MFA could be bypassed if the login policy did not explicitly require MFA, allowing sessions authenticated with a single factor to remain valid. An attacker could target a six‑digit TOTP code and bypass passw...

CVE-2025-11374

CVE-2025-11374 affects HashiCorp Consul and Consul Enterprise, specifically the key/value endpoint, due to incorrect Content Length header validation leading to DoS. IBM’s security bulletin documents affected versions: Consul Community Edition 0.0.1–1.21.5 and Consul Enterprise 1.21.0–1.21.51.20....

Consul's KV endpoint is vulnerable to denial of service

Summary Consul and Consul Enterprise’s “Consul” key/value endpoint is vulnerable to denial of service DoS due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12...

CVE-2025-11971

GitLab EE fixed CVE-2025-11971, which allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits. Affected versions were 10.6 to before 18.3.5, 18.3.x before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1; remediation was released as patch updates (n...

EUVD-2025-35718

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON...

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

Vault and Vault Enterprise's "Vault" AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5,...

CVE-2025-11621

Vault and Vault Enterprise’s “Vault” AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise...

CVE-2025-59530

CVE-2025-59530 affects quic-go, a QUIC protocol implementation in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0 a misbehaving or malicious server can trigger an assertion during the handshake, causing a DoS by crashing the client. This requires no authentication and can occur during the han...

EUVD-2020-25326

Malware in sbrugna...

EUVD-2021-26499

Malware in sbrugna...

EUVD-2020-0213

Malware in sbrugna...

EUVD-2020-0447

Malware in sbrugna...

EUVD-2020-28251

Malware in sbrugna...

EUVD-2017-16263

Malware in sbrugna...

EUVD-2021-10024

Malware in sbrugna...

EUVD-2019-10104

Malware in sbrugna...

EUVD-2020-25374

Malware in sbrugna...

EUVD-2015-7364

Malware in sbrugna...

PT-2025-41013

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2 Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component stores non-file form fields in memory as Ruby String object...