CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

PT-2025-9316 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions through 0.95.1 Description: The issue is related to improper privilege management in a REST interface, allowing registered users to access unauthorized resources if the resource ID is known. Recommendations: Upgrad...

Race Condition

Overview kuzu is an An in-process property graph database management system built for query speed and scalability. Affected versions of this package are vulnerable to Race Condition in their random number generation routines in randomengine.cpp file. The vulnerable functions were the unsynchronis...

PT-2025-8962 · B1Gmail · B1Gmail

Name of the Vulnerable Software and Affected Versions: b1gMail versions up to 7.4.1-pl1 Description: A problematic issue was found in the Admin Page component, specifically in the file src/admin/users.php, where the manipulation of the query/q argument leads to deserialization. This issue can be...

CKEditor 41.3.0 < 44.2.1 XSS

The version of CKEditor included on the remote web host is 41.3.0 prior to 44.2.1. It may, therefore, be affected by a cross-site scripting XSS vulnerability. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code...

Google Chrome Security Update (stable-channel-update-for-desktop_25-2025-02) - Mac OS X

Google Chrome is prone to an Out of bounds read vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

CVE-2025-1644 Benner ModernaNet SG_Gravar cross-site request forgery

A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SGGravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to...

CVE-2025-1643 Benner ModernaNet SG_AlterarSenha cross-site request forgery

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SGAlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1....

CVE-2025-1642 Benner ModernaNet GetImageMedico resource injection

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiat...

CVE-2025-1640 Benner ModernaNet JS_CarregaCombo sql injection

A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file...

PT-2025-7805 · Unknown · Benner Modernanet

Name of the Vulnerable Software and Affected Versions: Benner ModernaNet versions 1.1.0 and earlier Description: A critical issue has been identified in Benner ModernaNet, affecting unknown code in the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the fooId argument leads to improp...

PT-2025-7845 · Estatik · Estatik Mortgage Calculator

Name of the Vulnerable Software and Affected Versions: Mortgage Calculator Estatik versions n/a through 2.0.12 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XS...

Google Chrome < 133.0.6943.141 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 133.0.6943.141. It is, therefore, affected by a vulnerability as referenced in the 202502stable-channel-update-for-desktop25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the...

PT-2025-7820 · WordPress · Enfold

Name of the Vulnerable Software and Affected Versions: Enfold theme for WordPress versions up to, and including, 6.0.9 Description: The issue allows unauthorized access to data due to a missing capability check in the avia-export-class.php file. This enables unauthenticated attackers to export al...

CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...

Incorrect Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access controls in the feedback response handling process. An attacker can view or delete feedback responses by exploiting the lack of proper...

Solon Path Traversal

A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal:...

CVE-2025-25299

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting XSS vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within...

SUSE SLES12 Security Update : postgresql14 (SUSE-SU-2025:0615-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0615-1 advisory. Upgrade to 14.17: - CVE-2025-1094: Harden PQescapeString and allied functions against invalidly-encoded input strings bsc1237093. Tenable has extracted...

SUSE SLES15: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2025:0631-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0631-1 advisory. Upgrade to 14.17: - CVE-2025-1094: Harden PQescapeString and allied functions against invalidly-encoded input strings...