sz-photo.de Cross Site Scripting vulnerability OBB-4033926

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2025-27816

A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization of potentially untrusted messages. The vulnerability is present in the Windows PluginHost service, which runs on all the servers where...

CVE-2024-58073

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check dpuplaneatomicprintstate for valid sspp Similar to the rpipe sspp protect, add a check to protect the pipe state prints to avoid NULL ptr dereference for cases when the state is dumped without a corresponding...

CVE-2025-0360

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API...

GHSA-GH9Q-2XRM-X6QV CGI has Denial of Service (DoS) potential in Cookie.parse

There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into t...

CVE-2025-1840

creationtimestamp| type| source ---|---|--- 2025-03-03 00:29:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6118 2025-03-03 01:30:33+00:00| published-proof-of-concept| Telegram/pstnQ8ZZOX-2Yeq-UDXjBXIKQOIrf-BFgYyilC58DHdCcZU 2025-03-03 02:34:12+00:00| seen|...

WordPress WooCommerce Ultimate Gift Card plugin < 2.9.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Tonn in WordPress Plugin WooCommerce Ultimate Gift Card versions 2.9.3...

AWS VDP: (Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The non-production API endpoints for the Datazone service failed to log to CloudTrail, resulting in silent permission enumeration. The vulnerability was discovered through certificate transparency monitoring, where three additional vulnerable endpoints were identified...

CVE-2022-49524

In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885initdev When the driver fails to call the dmasetmask, the driver will get the following splat: 55.853884 BUG: KASAN: use-after-free in processremoveddriver+0x3c/0x240 55.85448...

CVE-2025-25794

SeaCMS v13.3 was discovered to contain a remote code execution RCE vulnerability via the component adminping.php...

CVE-2024-12918

creationtimestamp| type| source ---|---|--- 2025-02-24 17:21:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5189 2025-02-24 17:48:28+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114060119765999360 2025-02-24 19:32:23+00:00| seen|...

CVE-2024-36670

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component admin/vpsClassdeal.php?mudi=del...

Drupal Open Social module < 12.3.11,12.4.0-12.4.9 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Robert Ragas robertragas in WordPress Module Open Social versions 12.3.11,12.4.0-12.4.9...

XVIDEOS: Error Page Content Spoofing or Text Injection

F4027663 Title: Error Page Content Spoofing or Text Injection URL: https://www.xvcams.com/assets/!!!ATENTION!%20This%20server%20is%20on%20Maintenance%20please%20go%20to%20WWW.EVIL.COM ---...

CVE-2024-7798

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username lead...

CVE-2024-7886

A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real...

[SECURITY] [DSA 5857-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5857-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 03, 2025 https://www.debian.org/security/faq -...

WordPress Appointment Buddy Widget By Accrete plugin <= 1.2. - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dimas Maulana in WordPress Plugin Appointment Buddy Widget versions = 1.2...

WordPress WP Admin Custom Page plugin <= 1.5.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin WP Admin Custom Page versions = 1.5.0...

ABB Cylon FLXeon 9.3.4 (cmds.js) Authenticated Root Remote Code Execution

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...