13507 matches found
CVE-2025-27217
A Server-Side Request Forgery SSRF in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope...
CVE-2025-51989
HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" firstname field, which will be sent out in an email resulting in possible Phishing scenarios against any, previously not...
PT-2025-34176 · Ubiquiti · Uisp Application
Name of the Vulnerable Software and Affected Versions: UISP Application affected versions not specified Description: A Server-Side Request Forgery SSRF exists in the UISP Application. This issue may allow a malicious actor with certain permissions to make requests outside of the application’s...
AVEVA PI Integrator security vulnerabilities
AVEVA PI Integrator is a business analysis tool from AVEVA UK. A security vulnerability exists in AVEVA PI Integrator that stems from the potential for authenticated users to retrieve sensitive information that could lead to additional access to downstream resources...
INFINITT PACS System Manager security vulnerabilities
INFINITT PACS System Manager is a medical image archiving and transfer system from INFINITT Corporation. A security vulnerability exists in INFINITT PACS System Manager that originates from unauthorized access and could result in system resources being accessed...
CVE-2025-54988
An XML External Entity injection flaw was found in the Apache Tika tika-parser-pdf-module. This vulnerability allows an attacker to provide a crafted XFA file within a PDF, read sensitive data, or trigger malicious requests to internal resources or third-party servers. Mitigation Mitigation for...
CVE-2025-5115
In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send RSTSTREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume...
CVE-2025-8415
A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment. Mitigation...
tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...
tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...
tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...
tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...
tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...
CVE-2025-1139
IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment...
CVE-2025-1139
IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment...
CVE-2025-1139
CVE-2025-1139 affects IBM Edge Application Manager 4.5. A local user can read or modify resources due to incorrect permission assignment. Root cause: improper/incorrect permission provisioning. Impact: unauthorized access to resources on the device. Mitigation: upgrade to patched IBM Edge Applica...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in WebhookUtil.java. An attacker can access or manipulate internal server resources by sending crafted requests that are processed by the server. Remediation Upgrade org.apache.eventmesh:eventmesh-runtim...
Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java
Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes th...
CVE-2024-39954
CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...
CVE-2024-39954 Apache EventMesh Runtime: SSRF
CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...