CVE-2025-4210

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgradi...

CVE-2025-4210 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgradi...

CVE-2025-4210

Casdoor SCIM User Creation Endpoint (controller: SCIM.go HandleScim) up to version 1.811.0 contains an authorization bypass caused by manipulation in HandleScim. This allows remote attackers to bypass authorization. A fix is available in version 1.812.0, with patch hash 3d12ac8dc2282369296c338681...

PT-2025-18921 · Unknown +1 · Ublock Origin +1

Name of the Vulnerable Software and Affected Versions: uBlock Origin versions up to 1.63.3b16 Description: A vulnerability was found in uBlock Origin, classified as problematic. The function currentStateChanged of the file src/js/1p-filters.js of the component UI is affected. The manipulation lea...

GHSA-QGP8-V765-QXX9 @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Summary PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework. However, it was found that an attacker could cause the check to be skipped. Impact PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension ...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview github.com/elastic/elastic-agent/internal/pkg/agent/application is a single, unified way to add monitoring for logs, metrics, and other types of data to a host Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere d...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of pywsgi Input.send100continue. An attacker could extract data or compromise data integrity by sending a request with an Expect: 100-continue header. Remediation Upgrade gevent to version...

Incorrect Default Permissions

Overview docksible is a Deploy and set up Docker Compose based web apps with Ansible Affected versions of this package are vulnerable to Incorrect Default Permissions via the file permissions of docker-compose files. An attacker could gain unauthorized access to sensitive configuration data or...

Debian dla-4149 : nagvis - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4149 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4149-1 [email protected]...

Inefficient Algorithmic Complexity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the inputprocessorforphi4mm function. An attacker can cause the application to consume excessive resource...

Debian dla-4143 : glibc-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4143 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4143-1 [email protected] https://www.debian.org/lts/security/...

Apache Tomcat 11.0.0.M1 < 11.0.6 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.6security-11 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a...

Apache Tomcat 10.1.0.M1 < 10.1.40 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.40. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.40security-10 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a...

Apache Tomcat 9.0.0.M1 < 9.0.104 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.104. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.104security-9 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a...

GHSA-PJR6-JX7R-J4R6 Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1. An upgraded version of the package is available that resolves this issue...

Binding to an Unrestricted IP Address

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address through the XPUB ZeroMQ socket. When connected, an attacker will receive internal vLLM state information data...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output due to the improper handling of TextArea properties with default content types. An attacker can execute arbitrary scripts that impact the confidentiality, integrity, and availability of the XWiki...

CVE-2025-30194

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A...

CVE-2025-30194

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A...