WordPress Show Analytics widget plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due to insufficient validation of...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that can be exploited by an attacker to compromise availability...

Information Leakage Vulnerability in Education Cloud Application Center of Beijing Software Branch of KDDI (Beijing) Co.

Ltd. has been engaged in the research of core artificial intelligence technologies such as intelligent speech, computer vision, natural language processing, cognitive intelligence and other core technologies and maintains the international cutting-edge level. There is an information leakage...

IBM Cognos Analytics 11.2.x < 11.2.4 FP5 / 12.0.x < 12.0.4 IF1 Multiple Vulnerabilities (7179496)

The version of IBM Cognos Analytics installed on the remote host is prior to 11.2.4 FP5 or 12.0.4 IF1. It is, therefore, affected by multiple vulnerabilities as referenced in the 7179496 advisory. - IBM Cognos Analytics is vulnerable to an Expression Language EL Injection vulnerability. A remote...

CVE-2024-52049

A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52048. Please note: an attacker must first obtain the ability to execute low-privileged...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Insights uses a web link with untrusted references to an external site.

Summary IBM Engineering Lifecycle Optimization - Engineering Insights uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims' web browser. The web application...

Huawei HarmonyOS buffer overflow vulnerability (CNVD-2025-1334123)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a buffer overflow vulnerability. The vulnerability originates from the M3U8 module and can be exploited by an attacker to cause...

CVE-2024-55470

Oqtane Framework 6.0.0 is affected by Incorrect Access Control. The vulnerability arises from insufficient server-side validation of the entityid parameter, allowing an attacker to bypass passcode validation and log in or access restricted data. The root cause is reliance on client-side authentic...

File Upload Vulnerability in H3C Intelligent Management Center of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is a global leader in digital solutions. A file upload vulnerability exists in the H3C Intelligent Management Center of Xinhua San Technologies Limited, which can be exploited by an attacker to gain control of the server...

CVE-2024-48007

CVE-2024-48007 affects Dell RecoverPoint for Virtual Machines, version 6.0.x. The vulnerability stems from hard-coded credentials in the software, enabling a remote, unauthenticated attacker to access secrets and, consequently, unauthorized data. Documents consistently describe the impact as enab...

Microsoft Office Elevation of Privilege Vulnerability (CNVD-2025-05234)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. An elevation of privilege vulnerability exists in Microsoft Office. An attacker can exploit this...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2025-02842)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. A security vulnerability exists in Adobe Connect that can be exploited by an attacker to inject malicious scripts into vulnerable form fields...

TP-LINK VN020 Buffer Overflow Vulnerability

The TP-LINK VN020 is a wireless modem from China P&L TP-LINK. A security vulnerability exists in TP-Link VN020 F3vT TTV6.2.1021 version, which originates from a buffer overflow in the parameter NewConnectionType in the component SOAP request handler. An attacker can exploit this vulnerability to...

Unspecified Vulnerability in ABB ASPECT

ABB ASPECT is a scalable building energy management and control solution from ABB Switzerland. ABB ASPECT has a security vulnerability that stems from the inclusion of a weak password reset rule vulnerability. An attacker could exploit this vulnerability to gain unauthorized...

CVE-2024-12570 Privilege Context Switching Error in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's CIJOBTOKEN to obtain a GitLab session token belonging to the victim...

CVE-2024-11052

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for...

Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2024-52865

Adobe Experience Manager; CVE-2024-52865 affects AEM 6.5.21 and earlier with a stored cross-site scripting (XSS) flaw in vulnerable form fields. Underlying issue: improper input handling allows injection of malicious JavaScript, which can run in a user’s browser when visiting a page containing th...

CVE-2024-43724 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user inpu...