1651 matches found
PT-2025-24688 · Erxes · Erxes
Name of the Vulnerable Software and Affected Versions: Erxes versions prior to 1.6.2 Description: The issue allows an unauthenticated attacker to read arbitrary files from the system using a Path Traversal vulnerability in the "/read-file" endpoint handler. Recommendations: For versions prior to...
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Summary An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues e.g., HAX-3...
CVE-2025-46204
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/id endpoint...
How Microsoft Defender for Endpoint is redefining endpoint security
Securing your digital estate with endpoint detection and response EDR across all platforms, devices, and Internet of Things IoT has never been more challenging. A rapidly evolving cyberthreat landscape has seen cyberattacks grow in sophistication, evolving from randomized single domain cyberattac...
PT-2025-23646 · Unknown · Quequnlong Shiyi-Blog
Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper...
CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...
PT-2025-23230 · Navidrome +1 · Navidrome +1
Name of the Vulnerable Software and Affected Versions: Navidrome versions 0.55.0 through 0.55.2 Description: The issue arises due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially...
Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
Impact All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. Attack...
Fortinet FortiClientEMS Path Traversal Vulnerability
Fortinet FortiClientEMS is part of Fortinet's Endpoint Management solution from Fortinet, a U.S.-based company, and is designed to help organizations effectively manage endpoint devices in their networks and provide monitoring and control of endpoint security. A path traversal vulnerability exist...
PT-2025-23221 · Valtimo · Valtimo
Name of the Vulnerable Software and Affected Versions: Valtimo versions 11.0.0.RELEASE through 11.3.3.RELEASE Valtimo versions 12.0.0.RELEASE through 12.12.0.RELEASE Description: The issue allows unauthorized users to list, view, edit, create, or delete objects for which an object-management...
PT-2025-22901 · Gestnet · Gestnet
Name of the Vulnerable Software and Affected Versions: Gestnet version 1.07 Description: This issue allows an attacker to retrieve, create, update, and delete databases via the fk remoto central parameter on the "/webservices/articles.php" endpoint. Recommendations: For Gestnet version 1.07, as a...
CVE-2024-42626
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/snippet/add...
CVE-2024-9387
An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint...
CVE-2024-24912
A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system...
CVE-2024-4311
zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...
CVE-2023-52337
An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileg...
CVE-2023-42854
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to cause a denial-of-service to Endpoint Security clients...
CVE-2023-31497
Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security EPS all versions prior to v8.0 allows attackers to escalate privileges to root via supplying a crafted binary to the target system...