CVE-2025-20302

CVE-2025-20302 : Cisco Secure FMC Software’s web-based management interface contains a missing authorization check that could let an authenticated, low-privileged, remote attacker retrieve a generated report from a different domain managed on the same FMC instance. The attacker could directly acc...

Cisco Secure Firewall Management Center 安全漏洞

Cisco Secure Firewall Management Center is a powerful network security management tool from Cisco USA. A security vulnerability exists in Cisco Secure Firewall Management Center that stems from a missing authorization check and could lead to cross-domain access to sensitive information...

PT-2025-33337 · Cisco · Cisco Secure Fmc

Name of the Vulnerable Software and Affected Versions: Cisco Secure FMC Software affected versions not specified Description: A vulnerability exists in the web-based management interface of Cisco Secure FMC Software that could allow an authenticated, low-privileged, remote attacker to access...

Cisco Secure Firewall Management Center 安全漏洞

Cisco Secure Firewall Management Center is a powerful network security management tool from Cisco USA. A security vulnerability exists in Cisco Secure Firewall Management Center that stems from a missing authorization check and could result in cross-domain access to reported information...

CVE-2021-20148

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another...

CVE-2020-15860

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

CVE-2012-3557

Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site...

CVE-2009-2282

The Virtual Network Terminal Server daemon vntsd for Logical Domains aka LDoms in Sun Solaris 10, and OpenSolaris snv41 through snv108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown...

Flask-CORS 安全漏洞

Flask-CORS is a cross-origin resource sharing component for Flask by the individual developer Cory Dolphin. A security vulnerability exists in Flask-CORS version 4.01, which stems from a case-insensitive request path matching that could lead to unauthorized cross-domain access...

PT-2025-9042 · Syspass · Syspass

Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A host header injection vulnerability in SysPass allows an attacker to load malicious JS files from an arbitrary domain, which would be executed in the victim's browser. Recommendations: For SysPass version...

CVE-2024-51503

A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to...

Malicious code in godaddy-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af949cfb5a5349e6685c85de7c1f23beb51e56c772e2c6f19ec5f00e0a87e407 The OpenSSF Package Analysis project identified 'godaddy-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2024-51503

A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to...

CVE-2024-51503

Summary: CVE-2024-51503 affects Trend Micro Deep Security Agent 20 (manual scan command injection). The vulnerability exists in the agent’s Notifier component and, under certain conditions, allows an attacker with legitimate domain access to escalate privileges and execute arbitrary code on remot...

Mozilla Firefox Origin Authentication Error Vulnerability

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. Mozilla Firefox suffers from an origin validation error that originates...

CVE-2023-43041

IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data from other domains. This vulnerability is due to an incomplete fix for CVE-2022-34352. IBM X-Force ID: 266808...

PT-2023-8495 · Xen +3 · Xen +3

Name of the Vulnerable Software and Affected Versions: Xen affected versions not specified Description: The issue is related to the functionality of phantom functions in PCI devices, which can generate requests using the IDs of unpopulated functions, allowing a device to extend the number of...

PT-2023-5198 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM version 7.5.0 Description: The issue is related to the exposure of protected information. It allows a remote attacker to gain unauthorized access to sensitive data. Specifically, a delegated Admin tenant user with a specific...

SUSE CVE-2022-42334

x86/HVM pinned cache attributes mis-handling This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults...

Webpack 安全漏洞

Webpack is a module packager. Its primary purpose is to bundle JavaScript files for use in the browser, but it is also capable of converting, bundling, or packaging almost any resource or asset. A security vulnerability exists in Webpack version 5 up to and including 5.76.0 that stems from not...