Threat intelligence, made actionable Get actionable vulnerability briefings: affected platforms, exploit intelligence, severity, vendor advisories and remediation guidance. Subscribe to the technologies that matter to your environment.
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the…
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the vic…
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.