2025-07-11 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2025-27889	wftpserver - Wing FTP Server	Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.	CVSS3.1: 3.4 - LOW	0 1 2	Exploitation: pocAutomatable: noTechnical Impact: partial	undefined	github
CVE-2025-27613	j6t - gitk	Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk’s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.	CVSS3.1: 3.6 - LOW	0 1 2	Exploitation: noneAutomatable: noTechnical Impact: partial	Gitk can create and truncate files in the user’s home directory	github
CVE-2023-50458	dradisframework - Dradis	In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users’ jobs.	CVSS3.1: 3.5 - LOW	0 1	Exploitation: noneAutomatable: noTechnical Impact: partial	undefined	github
CVE-2025-0141	Palo Alto Networks - GlobalProtect AppPalo Alto Networks - GlobalProtect AppPalo Alto Networks - GlobalProtect UWP AppPalo Alto Networks - GlobalProtect App	An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.	CVSS4.0: 8.4 - HIGH	0	Exploitation: noneAutomatable: noTechnical Impact: total	GlobalProtect App: Privilege Escalation (PE) Vulnerability	github