CVE-2019-25234 Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS

SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious...

CVE-2019-25234

CVE-2019-25234 affects Carlo Gavazzi SmartHouse Webapp 6.5.33. The connected documents confirm multiple vulnerabilities: cross-site request forgery (CSRF) and cross-site scripting (XSS) that could allow attackers to perform unauthorized actions by tricking logged-in users into visiting malicious ...

CVE-2019-25234 Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS

SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious...

Carlo Gavazzi SmartHouse Webapp 安全漏洞

Carlo Gavazzi SmartHouse Webapp is a software platform for remote management of smart home devices from Carlo Gavazzi, USA. A security vulnerability exists in Carlo Gavazzi SmartHouse Webapp version 6.5.33, which stems from the presence of multiple cross-site request forgery and cross-site...

CVE-2019-25234: Improper Neutralization of Input During Web Page Generation

SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Kentico.Xperience.AspNetCore.WebApp is an assemblies and content items required to integrate Kentico Xperience into ASP.NET Core applications. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere through the...

CVE-2025-55749

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

ROS-20251202-04

A vulnerability in the V8 JavaScript script handler of Google Chrome browser is related to reading outside the boundaries of the buffer. Exploitation of the vulnerability could allow an attacker acting remotely to impact the availability of protected information Vulnerability in the WebApp Instal...

CVE-2025-55749

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

CVE-2025-55749

XWiki Jetty package (XJetty) exposes a context that allows static access to files under webapp/, leading to information disclosure of potentially credential-bearing files. Affected versions are 16.7.0–16.10.11, 17.4.4, and 17.7.0. The issue is fixed in 16.10.11, 17.4.4, and 17.7.0. Connected data...

CVE-2025-55749 The XWiki Jetty package (XJetty) allows accessing any application file through URL

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

EUVD-2025-200075

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

CVE-2025-55749 The XWiki Jetty package (XJetty) allows accessing any application file through URL

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

CVE-2025-55749 The XWiki Jetty package (XJetty) allows accessing any application file through URL

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

XWiki Jetty Package (XJetty) allows accessing any application file through URL

Impact In an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg,...

GHSA-53GX-J3P6-2RW9 XWiki Jetty Package (XJetty) allows accessing any application file through URL

Impact In an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg,...

PT-2025-54746

Impact In an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg,...

The vulnerability of the WebApp Installs component of Google Chrome allows a hacker to replace the user interface.

The vulnerability of the WebApp Installs component of Google Chrome relates to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to replace the user interface with a specially created HTML page...

CVE-2025-55749: Improper Access Control

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package XJetty, a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials...

org.apache.causeway.core:causeway-core-interaction (>=4.0.0-m1, <=4.0.0-m2), org.apache.causeway.core:causeway-core-runtime (>=4.0.0-m1, <=4.0.0-m2) +87 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-metamodel (>=4.0.0-m1, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-metamodel MAVEN version =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0-m2 - org.apache.causeway.extensions:causeway-extensions-executionlog-appl...