Symlink Attack

Overview std/os is a Go standard library package std/os Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems,...

Symlink Attack

Overview std/syscall is a Go standard library package std/syscall Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix...

Incorrect Privilege Assignment

Overview github.com/hashicorp/nomad/command/agent is a package part of hashicorp's nomad. Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to prefix-based ACL policy lookups. An attacker with knowledge of existing job names and permission to create a job can...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization over the /api/v4/teams/teamid endpoint. A user can view information about public teams they are not a member of. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.14,...

EulerOS 2.0 SP12 : vim (EulerOS-SA-2025-1607)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The...

CVE-2025-22829 Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for...

CVE-2025-22829 Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for...

CVE-2025-26521 Apache CloudStack: CKS cluster in project exposes user API keys

When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization via improper authorization. An attacker can gain access to restricted information by bypassing security controls without requiring user interaction...

PT-2025-24906

Name of the Vulnerable Software and Affected Versions .NET versions prior to 8.0.17 .NET versions prior to 9.0.6 Description A remote code execution vulnerability exists in .NET 8.0 and 9.0 due to improper validation of search paths in Microsoft.NETCore.App.Runtime. An attacker could exploit this...

PT-2025-25170 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.10.0.0 through 4.20.0.0 Description: A privilege escalation issue exists where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type, allowing the attacker to...

Important: apache-commons-beanutils

Issue Overview: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not...

PT-2025-25168 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions prior to 4.19.3.0 Apache CloudStack versions prior to 4.20.1.0 Description: A flaw in access control affects the "listTemplates" and "listIsos" APIs. A malicious Domain Admin or Resource Admin can exploit this issue...

taro-css-to-react-native Regular Expression Denial of Service vulnerability

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...

CVE-2025-5896 tarojs taro index.js redos

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...

DEBIAN-CVE-2025-5889

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely...

CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

[SECURITY] [DLA 4212-1] modsecurity-apache security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4212-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 09, 2025 https://wiki.debian.org/LTS -...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the use of template functions env and expandenv, which are enabled by default. An attacker can extract sensitive system data,...

PT-2025-24908 · Kde +4 · Konsole +4

Name of the Vulnerable Software and Affected Versions: konsole versions prior to 25.04.2 konsole versions 4:20.12.3 and earlier konsole versions 4:22.12.3 and earlier Description: The vulnerability in KDE Konsole allows remote code execution when loading URLs from scheme handlers such as ssh://,...