product: Microsoft Edge (Chromium-based)

vendor: Microsoft

status: affected

version_type: custom

ecosystem: windows/system

metric_type: Secondary

severity: high

part: a

vendor: microsoft

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

title: Microsoft Edge Chromium security vulnerability


product: Microsoft Edge for iOS

severity: medium

product: edge

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft Edge security vulnerability


product: Azure Local Cluster

metric_type: Primary

summary: Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.

title: Microsoft Azure Local Cluster security vulnerability


product: Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

product: Microsoft Visual Studio 2022 version 17.10

product: Microsoft Visual Studio 2022 version 17.12

product: Microsoft Visual Studio 2022 version 17.13

product: Microsoft Visual Studio 2022 version 17.8

summary: Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.


product: PowerShell 7.4

product: PowerShell 7.5

platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1507

product: Windows 10 Version 1607

product: Windows 10 Version 1809

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 version 22H2

product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: powershell

part: o

summary: Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.


product: Microsoft Exchange Server 2016 Cumulative Update 23

product: Microsoft Exchange Server 2019 Cumulative Update 14

product: Microsoft Exchange Server 2019 Cumulative Update 15

product: Microsoft Exchange Server Subscription Edition RTM

summary: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.


archetype: generic

summary: Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft Exchange Server security vulnerability


summary: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.


product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows Server 2016 security vulnerability


default_status: unaffected

product: Kibana

vendor: Elastic

version_type: semver

ecosystem: software/application

product: kibana

vendor: elastic

summary: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.


summary: Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

title: Elastic Kibana security vulnerability


product: Beats

status: Deferred

summary: An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.


summary: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

title: Elastic Kibana security vulnerability


product: Elastic Defend

summary: Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.

title: Elastic Elastic Defend security vulnerability


severity: critical

summary: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

title: Elastic Kibana security vulnerability


summary: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors


summary: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

title: Elastic Kibana security vulnerability


summary: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)


summary: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)


product: QRadar Suite Software

vendor: IBM

product: Cloud Pak for Security

vendor: ibm

summary: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.

title: Ibm Cloud Pak For Security security vulnerability


summary: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly validating API data input.


summary: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case management script creation due to the improper generation of code.


summary: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.


product: Security Guardium

summary: IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.


summary: IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

title: Ibm Security Guardium security vulnerability


summary: IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.


summary: IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.


product: Cognos Analytics

summary: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.

title: Ibm Cognos Analytics security vulnerability


product: SugarCRM

vendor: SugarCRM

summary: A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.

title: Sugarcrm security vulnerability


default_status: affected

product: JPlatform

vendor: Jalios

summary: Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5

title: Jalios Jplatform security vulnerability


archetype: xxe

summary: Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).

title: Jalios Jplatform security vulnerability


product: Aquatronica Controller System

vendor: Aquatronica

summary: An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.

title: Aquatronica Aquatronica Controller System security vulnerability


product: MiniDVBLinux

vendor: MiniDVBLinux

product: minidvblinux

vendor: minidvblinux

summary: An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC.


vendor: Hewlett Packard Enterprise (HPE)

vendor: arubanetworks

summary: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.

title: Arubanetworks Clearpass Policy Manager security vulnerability


platforms: Windows Linux MacOS iOS

product: Virtual Intranet Access (VIA)

summary: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM (root). A successful exploit could allow the creation of a Denial-of-Service (DoS) condition affecting the Microsoft Windows Operating System. This vulnerability does not affect Linux and Android based clients.

title: Hewlett Packard Enterprise (Hpe) Virtual Intranet Access (Via) security vulnerability


product: AOS-CX

summary: A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches.


product: Planning Analytics Local

ecosystem: javascript/npm

summary: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


product: InfoSphere Information Server

summary: IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.

title: Ibm Infosphere Information Server security vulnerability


product: Jazz Foundation

summary: IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.

title: Ibm Jazz Foundation security vulnerability


vendor: Broadcom

vendor: Dell

product: ControlVault3 Plus

summary: An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to trigger this vulnerability.

title: Broadcom Bcm5820X security vulnerability


product: CLICK Programmable Logic Controller

vendor: AutomationDirect

status: unaffected

summary: An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.

title: Automationdirect Click Programmable Logic Controller security vulnerability


product: OpenHarmony

vendor: OpenHarmony

ecosystem: operating-system

severity: low

product: openharmony

vendor: openatom

summary: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.


vendor: Inaba Denki Sangyo Co., Ltd.

version: v2.0.03P and earlier

summary: OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.


product: Movable Type (8.4.x series)

vendor: Six Apart Ltd.

version: 8.4.1 and earlier

product: Movable Type (8.0.x series)

version: 8.0.5 and earlier

product: Movable Type Advanced (8.4.x series)

product: Movable Type Advanced (8.0.x series)

product: Movable Type Premium (2.x series)

version: 2.06 and earlier

product: Movable Type Premium (Advanced Edition) (2.x series)

product: Movable Type Cloud Edition (8.x series)

product: Movable Type Premium Cloud Edition (2.x series)

summary: Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.


product: FileMegane

vendor: JIP InfoBridge Co., Ltd.

version: Versions above 1.0.0.0 prior to 3.4.0.0

summary: Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restricted file contents may be accessed.


summary: Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations may be performed.


summary: in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.


version: before version 14.1.31

summary: Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) One Boot Flash Update (Intel(R) Ofu) Software security vulnerability


product: AssetView

vendor: Hammock Corporation

product: AssetView CLOUD

summary: Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server where the product is running may be obtained and/or deleted by a remote unauthenticated attacker.


product: HMI ViewJet C-more series

vendor: JTEKT ELECTRONICS CORPORATION

version: All versions

product: HMI GC-A2 series

archetype: ssrf

summary: Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.

title: Jtekt Electronics Corporation Hmi Viewjet C-More Series security vulnerability


default_status: unknown

product: backdrop

vendor: backdropcms

summary: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.


summary: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.


vendor: synacor

summary: SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.

title: Synacor Zimbra Collaboration Suite security vulnerability


summary: SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.


product: nDPI

vendor: ntop

product: ndpi

summary: nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.


product: myPRO Manager

vendor: mySCADA

product: mypro

vendor: myscada

summary: mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.

title: Mattermost Mattermost Server security vulnerability


product: Apache Kvrocks

vendor: Apache Software Foundation

product: kvrocks

vendor: apache

summary: A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.


product: Album Reviewer

vendor: ed atrero

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ed atrero Album Reviewer albumreviewer allows Stored XSS.This issue affects Album Reviewer: from n/a through <= 2.0.2.

title: Ed Atrero Album Reviewer security vulnerability


product: Vignette Ads

vendor: topplugins

summary: Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0.2.

title: Topplugins Vignette Ads security vulnerability


product: WP Admin Custom Page

vendor: thunderbax

summary: Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Page: from n/a through <= 1.5.0.

title: Thunderbax Wp Admin Custom Page security vulnerability


product: Easy WP Tiles

vendor: Vasilis Triantafyllou

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through <= 1.

title: Vasilis Triantafyllou Easy Wp Tiles security vulnerability


product: WP Social Stream

vendor: Nirmal Kumar Ram

summary: Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through <= 1.1.

title: Nirmal Kumar Ram Wp Social Stream security vulnerability


product: Show notice or message on admin area

vendor: Venugopal

summary: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through <= 2.0.

title: Venugopal Show Notice Or Message On Admin Area security vulnerability


product: Graceful Email Obfuscation

vendor: nicholaswilson

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through <= 0.2.2.

title: Nicholaswilson Graceful Email Obfuscation security vulnerability


product: Easy Chart Builder for WordPress

vendor: dugbug

ecosystem: php/wordpress

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builder allows Stored XSS.This issue affects Easy Chart Builder for WordPress: from n/a through <= 1.3.

title: Dugbug Easy Chart Builder For Wordpress security vulnerability


product: Google Earth Embed

vendor: Andrew Norcross

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through <= 1.0.

title: Andrew Norcross Google Earth Embed security vulnerability


product: Simple Select All Text Box

vendor: Garrett Grimm

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.

title: Garrett Grimm Simple Select All Text Box security vulnerability


product: Kona Gallery Block

vendor: gubbigubbi

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.

title: Gubbigubbi Kona Gallery Block security vulnerability


product: Embed RSS

vendor: DeannaS

summary: Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Embed RSS: from n/a through <= 3.1.

title: Deannas Embed Rss security vulnerability


product: FlexIDX Home Search

vendor: Max Chirkov

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.

title: Max Chirkov Flexidx Home Search security vulnerability


product: EP4 More Embeds

vendor: Dave Lavoie

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dave Lavoie EP4 More Embeds ep4-more-embeds allows Stored XSS.This issue affects EP4 More Embeds: from n/a through <= 1.0.0.

title: Dave Lavoie Ep4 More Embeds security vulnerability


product: UniTimetable

vendor: antrouss

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antrouss UniTimetable unitimetable allows Stored XSS.This issue affects UniTimetable: from n/a through <= 1.1.

title: Antrouss Unitimetable security vulnerability


product: WP SimpleWeather

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.

title: Matt Mcbrien Wp Simpleweather security vulnerability


product: Secret Meta

vendor: WPDeveloper

summary: Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1.

title: Wpdeveloper Secret Meta security vulnerability


product: seekXL Snapr

vendor: Tim

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim seekXL Snapr seekxl-snapr allows Reflected XSS.This issue affects seekXL Snapr: from n/a through <= 2.0.6.

title: Tim Seekxl Snapr security vulnerability


product: WP Keyword Monitor

summary: Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.

title: Blackus3R Wp Keyword Monitor security vulnerability


product: Image Rotator

vendor: appten

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator appten-image-rotator allows Reflected XSS.This issue affects Image Rotator: from n/a through <= 2.0.

title: Appten Image Rotator security vulnerability


product: Dreamstime Stock Photos

vendor: dreamstime

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through <= 4.1.

title: Dreamstime Dreamstime Stock Photos security vulnerability


product: NextGen Cooliris Gallery

vendor: zackdesign

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.

title: Zackdesign Nextgen Cooliris Gallery security vulnerability


product: All push notification for WP

vendor: gtlwpdev

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through <= 1.5.3.

title: Gtlwpdev All Push Notification For Wp security vulnerability


product: Child Themes Helper

vendor: paulswarthout

summary: Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes Helper: from n/a through <= 2.2.7.

title: Paulswarthout Child Themes Helper security vulnerability


product: Breaking News Ticker

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker allows Stored XSS.This issue affects Breaking News Ticker: from n/a through <= 2.4.4.

title: Amitythemes.Com Breaking News Ticker security vulnerability


product: ReverbNation Widgets

vendor: reverbnationdev

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.

title: Reverbnationdev Reverbnation Widgets security vulnerability


product: RSS in Page

vendor: titusbicknell

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.This issue affects RSS in Page: from n/a through <= 2.9.1.

title: Titusbicknell Rss In Page security vulnerability


product: External Video For Everybody

vendor: kwiliarty

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for-everybody allows Stored XSS.This issue affects External Video For Everybody: from n/a through <= 2.1.1.

title: Kwiliarty External Video For Everybody security vulnerability


product: Links in Captions

vendor: Zack Katz

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through <= 1.2.

title: Zack Katz Links In Captions security vulnerability


product: Appointment Buddy Widget

vendor: accreteinfosolution

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting (XSS).This issue affects Appointment Buddy Widget: from n/a through <= 1.2.

title: Accreteinfosolution Appointment Buddy Widget security vulnerability


product: Cazamba

vendor: victoracano

summary: Cross-Site Request Forgery (CSRF) vulnerability in victoracano Cazamba cazamba allows Reflected XSS.This issue affects Cazamba: from n/a through <= 1.2.

title: Victoracano Cazamba security vulnerability


product: Munk Sites

vendor: MetricThemes

summary: Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.

title: Metricthemes Munk Sites security vulnerability


product: Yahoo BOSS

vendor: Josh Harrison

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.

title: Josh Harrison Yahoo Boss security vulnerability


product: Indeed API

vendor: bnielsen

summary: Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through <= 0.5.

title: Bnielsen Indeed Api security vulnerability


product: URL-Preview-Box

vendor: mraliende

summary: Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.

title: Mraliende Url-Preview-Box security vulnerability


product: Pop Up

vendor: coffeestudios

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through <= 0.1.

title: Coffeestudios Pop Up security vulnerability


product: Starter Templates by FancyWP

vendor: FancyWP

summary: Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.

title: Fancywp Starter Templates By Fancywp security vulnerability


product: OneStore Sites

vendor: sainwp

summary: Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1.

title: Sainwp Onestore Sites security vulnerability


product: SW Plus

vendor: shalomworld

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through <= 2.1.

title: Shalomworld Sw Plus security vulnerability


product: WP Vehicle Manager

vendor: JoomSky

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky WP Vehicle Manager js-vehicle-manager allows PHP Local File Inclusion.This issue affects WP Vehicle Manager: from n/a through <= 3.1.

title: Joomsky Wp Vehicle Manager security vulnerability


product: Event Kikfyre

vendor: Metagauss

summary: Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through <= 2.1.8.

title: Metagauss Event Kikfyre security vulnerability


product: WP Spell Check

vendor: WP Spell Check

summary: Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.

title: Wp Spell Check security vulnerability


product: Social Links

vendor: kareemsultan

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kareemsultan Social Links social-links allows Command Line Execution through SQL Injection.This issue affects Social Links: from n/a through <= 1.2.

title: Kareemsultan Social Links security vulnerability


product: Implied Cookie Consent

vendor: Senktec

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through <= 1.3.

title: Senktec Implied Cookie Consent security vulnerability


product: User Role

vendor: ehabstar

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through <= 1.0.

title: Ehabstar User Role security vulnerability


product: Like dislike plus counter

vendor: Zeshan Abdullah

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through <= 1.0.

title: Zeshan Abdullah Like Dislike Plus Counter security vulnerability


product: Link to URL / Post

vendor: sudipto

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post link-to-url-post allows Blind SQL Injection.This issue affects Link to URL / Post: from n/a through <= 1.3.

title: Sudipto Link To Url / Post security vulnerability


product: Smart Countdown FX

vendor: Alex Polonski

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through <= 1.5.5.

title: Alex Polonski Smart Countdown Fx security vulnerability


product: Top Bar – PopUps – by WPOptin

vendor: Danish Ali Malik

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows Reflected XSS.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.8.

title: Danish Ali Malik Top Bar – Popups – By Wpoptin security vulnerability


product: Woocommerce osCommerce Sync

vendor: Alejandro Aranda

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alejandro Aranda Woocommerce osCommerce Sync woo-oscommerce-sync allows Reflected XSS.This issue affects Woocommerce osCommerce Sync: from n/a through <= 2.0.20.

title: Alejandro Aranda Woocommerce Oscommerce Sync security vulnerability


product: Slide Banners

vendor: Melodic Media

summary: Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slide Banners: from n/a through <= 1.3.

title: Melodic Media Slide Banners security vulnerability


product: Theme Options Z

vendor: shyammakwana

summary: Cross-Site Request Forgery (CSRF) vulnerability in shyammakwana Theme Options Z theme-options-z allows Cross Site Request Forgery.This issue affects Theme Options Z: from n/a through <= 1.4.

title: Shyammakwana Theme Options Z security vulnerability


product: WizShop

vendor: hashshop

summary: Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.

title: Hashshop Wizshop security vulnerability


product: Easy Related Posts

vendor: xdark

summary: Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/a through <= 2.0.2.

title: Xdark Easy Related Posts security vulnerability


product: Status Updater

vendor: devu

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XSS.This issue affects Status Updater: from n/a through <= 1.9.2.

title: Devu Status Updater security vulnerability


product: Fyrebox Quizzes

vendor: CyrilG

summary: Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.

title: Cyrilg Fyrebox Quizzes security vulnerability


product: ZMSEO

vendor: zmseo

summary: Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1.


product: Contact Us By Lord Linus

vendor: Rohitashv Singhal

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rohitashv Singhal Contact Us By Lord Linus contact-us-by-lord-linus allows Reflected XSS.This issue affects Contact Us By Lord Linus: from n/a through <= 2.6.

title: Rohitashv Singhal Contact Us By Lord Linus security vulnerability


product: Facilita Form Tracker

vendor: orlandolac

summary: Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.

title: Orlandolac Facilita Form Tracker security vulnerability


product: Callback Request

vendor: NotFound

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Callback Request allows Reflected XSS. This issue affects Callback Request: from n/a through 1.4.

title: Notfound Callback Request security vulnerability


product: Delete Comments By Status

vendor: Shah Alom

summary: Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments By Status: from n/a through <= 2.1.1.

title: Shah Alom Delete Comments By Status security vulnerability


product: RJ Quickcharts

vendor: randyjensen

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows Stored XSS.This issue affects RJ Quickcharts: from n/a through <= 0.6.1.

title: Randyjensen Rj Quickcharts security vulnerability


product: Visitor Details

vendor: ravi Singh

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through <= 1.0.1.

title: Ravi Singh Visitor Details security vulnerability


product: WP Frontend Submit

vendor: newbiesup

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Reflected XSS.This issue affects WP Frontend Submit: from n/a through <= 1.1.0.

title: Newbiesup Wp Frontend Submit security vulnerability


product: Theme Demo Bar

vendor: zenverse

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zenverse Theme Demo Bar wordpress-theme-demo-bar allows Reflected XSS.This issue affects Theme Demo Bar: from n/a through <= 1.6.3.

title: Zenverse Theme Demo Bar security vulnerability


product: Custom Links On Admin Dashboard Toolbar

vendor: Victor Barkalov

summary: Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.

title: Victor Barkalov Custom Links On Admin Dashboard Toolbar security vulnerability


product: Optimate Ads

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through <= 1.0.3.

title: Shujahat21 Optimate Ads security vulnerability


product: Social Links

vendor: kareemsultan

summary: Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Cross Site Request Forgery. This issue affects Social Links: from n/a through 1.0.11.


product: On Page SEO + Whatsapp Chat Button

vendor: Rishi

summary: Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.

title: Rishi On Page Seo + Whatsapp Chat Button security vulnerability


product: WP Custom Post RSS Feed

vendor: Cynob IT Consultancy

summary: Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP Custom Post RSS Feed: from n/a through <= 1.0.0.

title: Cynob It Consultancy Wp Custom Post Rss Feed security vulnerability


product: Simple User Profile

vendor: Scriptonite

summary: Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through <= 1.9.

title: Scriptonite Simple User Profile security vulnerability


product: Fami Sales Popup

vendor: zankover

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup fami-sales-popup allows PHP Local File Inclusion.This issue affects Fami Sales Popup: from n/a through <= 2.0.0.

title: Zankover Fami Sales Popup security vulnerability


product: WP Less Compiler

vendor: The Jake Group

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through <= 1.3.0.

title: The Jake Group Wp Less Compiler security vulnerability


product: GlobalQuran

vendor: ibasit

summary: Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through <= 1.0.

title: Ibasit Globalquran security vulnerability


product: Theasys

vendor: theasys

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theasys Theasys theasys allows Stored XSS.This issue affects Theasys: from n/a through <= 1.0.1.

title: Theasys security vulnerability


product: Infusionsoft Analytics

summary: Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through <= 2.0.

title: Jordan.Hatch Infusionsoft Analytics security vulnerability


product: Songkick Concerts and Festivals

vendor: saleandro

summary: Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.

title: Saleandro Songkick Concerts And Festivals security vulnerability


product: Auto SEO

summary: Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6.

title: Phillip.Gooch Auto Seo security vulnerability


product: Read More Copy Link

vendor: ElbowRobo

summary: Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.

title: Elbowrobo Read More Copy Link security vulnerability


product: Login-box

vendor: Danillo Nunes

summary: Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.

title: Danillo Nunes Login-Box security vulnerability


product: uListing

vendor: Stylemix

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.

title: Stylemix Ulisting security vulnerability


summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.


product: Smart DoFollow

vendor: LukaszWiecek

summary: Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.

title: Lukaszwiecek Smart Dofollow security vulnerability


product: Simple Auto Tag

vendor: djjmz

summary: Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.

title: Djjmz Simple Auto Tag security vulnerability


product: Custom Comment Notifications

vendor: scweber

summary: Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.

title: Scweber Custom Comment Notifications security vulnerability


product: Music Sheet Viewer

vendor: efreja

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traversal.This issue affects Music Sheet Viewer: from n/a through <= 4.1.

title: Efreja Music Sheet Viewer security vulnerability


product: Quote Comments

vendor: Stanko Metodiev

summary: Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.

title: Stanko Metodiev Quote Comments security vulnerability


product: WP Church Center

vendor: wpchurchteam

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Reflected XSS.This issue affects WP Church Center: from n/a through <= 1.3.3.

title: Wpchurchteam Wp Church Center security vulnerability


product: Uncomplicated SEO

vendor: Antonio Sanchez

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allows Reflected XSS.This issue affects Uncomplicated SEO: from n/a through <= 1.2.

title: Antonio Sanchez Uncomplicated Seo security vulnerability


product: WP doodlez

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through <= 1.0.10.

title: Robert Kolatzek Wp Doodlez security vulnerability


product: Style Tweaker

vendor: Mark Barnes

vendor: markbarnes

status: Modified

summary: Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.

title: Markbarnes Style Tweaker security vulnerability


product: WP Find Your Nearest

vendor: SocialEvolution

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Reflected XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

title: Socialevolution Wp Find Your Nearest security vulnerability


product: Sports Rankings and Lists

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kutu62 Sports Rankings and Lists sports-rankings-lists allows Absolute Path Traversal.This issue affects Sports Rankings and Lists: from n/a through <= 1.0.2.

title: Kutu62 Sports Rankings And Lists security vulnerability


product: Plugin A/B Image Optimizer

vendor: Zach Swetz

vendor: pluginab

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.

title: Pluginab Plugin A/B Image Optimizer security vulnerability


product: Meta Accelerator

vendor: Yuichiro ABE

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Reflected XSS.This issue affects Meta Accelerator: from n/a through <= 1.0.4.

title: Yuichiro Abe Meta Accelerator security vulnerability


vendor: richardgabriel

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory staff-directory-pro allows Stored XSS.This issue affects Staff Directory Plugin: Company Directory: from n/a through <= 4.3.

title: Richardgabriel Staff Directory Plugin: Company Directory security vulnerability


product: InLocation

vendor: gabrieldarezzo

product: inlocation

summary: Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.

title: Gabrieldarezzo Inlocation security vulnerability


product: BookPress – For Book Authors

vendor: Black and White

product: bookpress

vendor: blackandwhitedigital

summary: Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.

title: Blackandwhitedigital Bookpress security vulnerability


summary: Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.


product: Authors Autocomplete Meta Box

vendor: Rachel Cherry

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.

title: Rachel Cherry Authors Autocomplete Meta Box security vulnerability


product: Migrate Posts

vendor: DotsquaresLtd

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.

title: Dotsquaresltd Migrate Posts security vulnerability


product: WP SmartPay

vendor: Convers Lab

summary: Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.

title: Convers Lab Wp Smartpay security vulnerability


product: VidMov

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through <= 1.9.4.

title: Beeteam368 Vidmov security vulnerability


product: FastBook

vendor: FasterThemes

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through <= 1.1.

title: Fasterthemes Fastbook security vulnerability


product: BeeTeam368 Extensions

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.

title: Beeteam368 Beeteam368 Extensions security vulnerability


product: Simcenter Femap V2401

vendor: Siemens

product: Simcenter Femap V2406

vendor: siemens

summary: A vulnerability has been identified in Simcenter Femap V2401 (All versions < V2401.0003), Simcenter Femap V2406 (All versions < V2406.0002). The affected application contains a memory corruption vulnerability while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-25443)


platforms: Linux Android

product: Graphics DDK

vendor: Imagination Technologies

product: ddk

vendor: imaginationtech

summary: Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.

title: Imaginationtech Ddk security vulnerability


summary: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.


summary: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.


summary: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.


summary: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.

title: Imagination Technologies Graphics Ddk security vulnerability


product: VeraCore

vendor: Advantive

known_ransomware_campaign_use: Unknown

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Advantive

vulnerability_name: Advantive VeraCore SQL Injection Vulnerability

product: veracore

vendor: advantive

summary: A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.


product: stroom

vendor: gchq

summary: Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution or further privileges escalations when using the AWS metadata URL. This scenario assumes that Stroom must be configured to use ALB Authentication integration and the application is network accessible. The vulnerability has been fixed in versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2.


product: rack

vendor: rack

summary: Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.


vendor: binary-husky

summary: GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it. Subsequently, when accessing the decompressed file from the server, the soft link will point to the target file on the victim server. The vulnerability allows attackers to read all files on the server.


product: net-imap

vendor: ruby

summary: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.


product: joplin

summary: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive `script-src`. This allows arbitrary JavaScript execution via inline `onclick`/`onload` event handlers in unsanitized HTML. Additionally, Joplin's main window is created with `nodeIntegration` set to `true`, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses ctrl-p to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.


product: hickory-dns

vendor: hickory-dns

summary: Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.


product: ZOO-Project

vendor: ZOO-Project

version: < 7a5ae1a

summary: The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) publish.py CGI script prior to commit 7a5ae1a. The script reflects user input from the `jobid` parameter in its HTTP response without proper HTML encoding or sanitization. When a victim visits a specially crafted URL pointing to this endpoint, arbitrary JavaScript code can be executed in their browser context. The vulnerability occurs because the CGI script directly outputs the query string parameters into the HTML response without escaping HTML special characters. An attacker can inject malicious JavaScript code through the `jobid` parameter which will be executed when rendered by the victim's browser. Commit 7a5ae1a contains a fix for the issue.


summary: The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (XSS) vulnerability in its EchoProcess service prior to commit 7a5ae1a. The vulnerability exists because the EchoProcess service directly reflects user input in its output without proper sanitization when handling complex inputs.The service accepts various input formats including XML, JSON, and SVG, and returns the content based on the requested MIME type. When processing SVG content and returning it with the image/svg+xml MIME type, the server fails to sanitize potentially malicious JavaScript in attributes like onload, allowing arbitrary JavaScript execution in the victim's browser context. This vulnerability is particularly dangerous because it exists in a service specifically designed to echo back user input, and the lack of proper sanitization in combination with SVG handling creates a reliable XSS vector. Commit 7a5ae1a contains a fix for the issue.


product: groupoffice

vendor: Intermesh

vendor: group-office

summary: Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.


product: glpi

vendor: glpi-project

summary: GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.


product: netty

vendor: netty

summary: Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.


product: lemmy

vendor: LemmyNet

summary: Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypub_federation and versions 0.19.8 and prior of Lemmy, allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. As of time of publication, a fix has not been made available.

title: Lemmynet Lemmy security vulnerability


product: zulip

vendor: zulip

summary: Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive." The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.


product: openfga

vendor: openfga

summary: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart < openfga-0.2.22, docker < v.1.8.4) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA v1.8.4 or previous, specifically under the following conditions are affected by this authorization bypass vulnerability: 1. Calling Check API or ListObjects with a model that has a relation directly assignable to both public access AND userset with the same type. 2. A type bound public access tuple is assigned to an object. 3. userset tuple is not assigned to the same object. and 4. Check request's user field is a userset that has the same type as the type bound public access tuple's user type. Users are advised to upgrade to v1.8.5 which is backwards compatible. There are no known workarounds for this vulnerability.


product: silverstripe-elemental

vendor: silverstripe

summary: Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. This vulnerability is fixed in 5.3.12.

title: Silverstripe Silverstripe-Elemental security vulnerability


product: mailcow-dockerized

vendor: mailcow

summary: mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.


product: go-crypto-winnative

vendor: microsoft

summary: go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41 contains a fix for the issue. The fix is included in versions 1.23.6-2 and 1.22.12-2 of the Microsoft build of go, as well as in the pseudoversion 0.0.0-20250211154640-f49c8e1379ea of the `github.com/microsoft/go-crypto-winnative` Go package.


product: koa

vendor: koajs

summary: Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.


vendor: Nitrokey

summary: Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the application. An attacker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such an attacker would not be able to read-out or extract existing private data, nor would they be able to gain access to cryptographic operations that would normally require PIN-based authentication. The issue is fixed in piv-authenticator 0.3.9, and in Nitrokey's firmware 1.8.1.


vendor: team-alembic

vendor: alembic

summary: Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource.


product: panel

vendor: Ctrlpanel-gg

summary: CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 contains a patch for the issue.


product: cli

vendor: cli

summary: `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.


product: audiobookshelf

vendor: advplyr

vendor: audiobookshelf

summary: Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.


product: elabftw

vendor: elabftw

summary: eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.


product: Red Hat Connectivity Link 1

vendor: Red Hat

part: redhat

summary: The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.


summary: A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster


summary: The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with a developer persona access to leak those secrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited to one line only.

title: Red Hat Red Hat Connectivity Link 1 security vulnerability


version: before version 16.0.12

summary: Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Server Firmware Update Utility(Sysfwupdt) security vulnerability


product: CHOCO TEI WATCHER mini (IB-MCT001)

vendor: Inaba Denki Sangyo Co., Ltd.

version: all versions

summary: Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.


product: OpenHarmony

vendor: OpenHarmony

product: openharmony

vendor: openatom

summary: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.


summary: Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed.


product: AVideo

vendor: WWBN

version: dev master commit 8a8954ff

product: avideo

vendor: wwbn

summary: A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.


vendor: Broadcom

vendor: Dell

product: ControlVault3 Plus

summary: An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.

title: Broadcom Bcm5820X security vulnerability


summary: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.


title: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference


product: +F FS010M

vendor: FUJI SOFT INCORPORATED

version: Versions prior to V2.0.1_1101

summary: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.

title: Fuji Soft Incorporated +F Fs010M security vulnerability


product: The LuxCal Web Calendar

vendor: LuxSoft

version: prior to 5.3.3M (MySQL version)

version: prior to 5.3.3L (SQLite version)

vendor: luxsoft

summary: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

title: Luxsoft Luxcal Web Calendar security vulnerability


summary: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.


summary: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.


summary: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.


product: Hikashop component for Joomla

product: hikashop

vendor: hikashop

summary: A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.

title: Hikashop security vulnerability


product: Joomla! Framework

vendor: Joomla! Project

product: joomla!

vendor: joomla

summary: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.


product: Joomla! CMS

summary: Insufficient state checks lead to a vector that allows to bypass 2FA checks.


product: Omnissa Workspace ONE UEM

vendor: Omnissa

version: Omnissa Workspace ONE UEM version 24.10.0.10 or earlier

version: Omnissa Workspace ONE UEM version 24.6.0.34 or earlier

version: Omnissa Workspace ONE UEM version 24.2.0.29 or earlier

version: Omnissa Workspace ONE UEM version 23.10.0.49 or earlier

summary: Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.


product: Omnissa Horizon Client for Windows

version: Omnissa Horizon Client for Windows 2412 or earlier

summary: Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able to elevate privileges.


summary: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.


product: Omnissa Unified Access Gateway (UAG)

version: Omnissa Unified Access Gateway 2412 or earlier

vendor: omnissa

summary: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.


product: Secure Email Gateway

version: 2.32 and later

version: 2503 and later

summary: Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network traffic such as HTTP requests to internal networks.

title: Omnissa Secure Email Gateway security vulnerability


version: Omnissa Workspace ONE UEM version prior to 24.10.0.25

version: Omnissa Workspace ONE UEM version prior to 24.6.0.44

version: Omnissa Workspace ONE UEM version prior to 24.2.0.36

summary: Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.


product: SAP Fiori Apps Reference Library (My Overtime Requests)

summary: Due to a missing authorization check, an attacker who is logged in to application can view/ delete My Overtime Requests which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability.

title: Sap Se Sap Fiori Apps Reference Library (My Overtime Requests) security vulnerability


product: SAP NetWeaver Application Server ABAP

version: SAP_BASIS 740

version: SAP_BASIS 750

version: SAP_BASIS 751

version: SAP_BASIS 752

version: SAP_BASIS 753

version: SAP_BASIS 754

version: SAP_BASIS 755

version: SAP_BASIS 756

version: SAP_BASIS 757

version: SAP_BASIS 758

version: SAP_BASIS 914

summary: SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

title: Sap Se Sap Netweaver Application Server Abap security vulnerability


version: SRM_MDM_CAT 7.52

summary: SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.

title: Sap Se Sap Supplier Relationship Management (Master Data Management Cat… security vulnerability


product: SAP Business Warehouse (Process Chains)

version: DW4CORE 100

version: SAP_BW 730

summary: SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.


version: ENTERPRISE 430

vendor: sap

summary: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim's browser. There is no impact on availability.

title: Sap Businessobjects Business Intelligence Platform security vulnerability


vendor: NETGEAR

summary: NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.


product: Apache Felix Webconsole

vendor: Apache Software Foundation

version: Version 4.x

version: Version 5.x

vendor: apache

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.


product: FortiOS

vendor: Fortinet

product: FortiPAM

product: FortiProxy

product: RUGGEDCOM APE1808

vendor: Siemens

product: fortios

vendor: fortinet

product: fortipam

product: fortiproxy

summary: An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.

title: Fortinet Fortiproxy security vulnerability


product: FortiSwitchManager

product: fortiswitchmanager

product: fortisase

summary: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

title: Fortinet Fortiswitchmanager security vulnerability


product: FortiSASE

summary: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

title: Fortinet Fortisase security vulnerability


product: FortiClientMac

product: forticlient

summary: An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker to escalate privileges via crafted XPC messages.

title: Fortinet Forticlient security vulnerability


summary: An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

title: Fortinet Fortios security vulnerability


summary: An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy


product: FortiWeb

product: fortiweb

summary: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.

title: Fortinet Fortiweb security vulnerability


summary: An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.


product: FortiSIEM

product: fortisiem

summary: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

title: Fortinet Fortisiem security vulnerability