Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

CVE-2026-67101

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-67101 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

EUVD-2026-82765

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-67101

HCL BigFix Service Management is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its search functionality . An attacker can exploit this to force the application server to send requests to internal systems that are otherwise inaccessible from the internet, with high confidentiality and...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: 反射型クロスサイトスクリプティング XSS 目次 概要 脆弱性の詳細 影響を受ける製品 技術的分析 概念実証 再現手順 影響 緩和策と是正措置 参考情報 免責事項 概要 Microworld Technologies eScan Management Console バージョン 14.0.1400.2281 に、反射型クロスサイトスクリプティング XSS の脆弱性が発見されました。認証済みのリモート攻撃者は、 レポートテンプレート 削除機能内の deletefile POST...

CVE-2026-32238_RemoteCodeExecutionOpenEMR8.0.0

CVE-2026-32238 - OpenEMR 脆弱性 CWE-78 : OSコマンドに使用される特殊要素の不適切な無害化（'OS Command Injection'） 本製品は、上流コンポーネントから外部の影響を受ける入力を使ってOSコマンドの全部または一部を構築しますが、下流コンポーネントに送信する際に、意図されたOSコマンドを変更し得る特殊要素を無害化しない、または誤って無害化します。 概要 OpenEMR 8.0.0.1...

CVE-2025-14598

CVE-2025-14598 CVSS: 9.8 Remote Unauthenticated SQL Injection leading to Remote Code Execution. Executive Summary A SQL Injection vulnerability was identified in the login functionality of BET e-Portal, a software solution widely deployed across educational institutions for student information an...

security-advisories

🔐 Minhajul Taivin によるセキュリティアドバイザリ 私が公開したCVE情報開示の公式リポジトリへようこそ。 このリポジトリには、私が発見した脆弱性に関する詳細なセキュリティアドバイザリ、概念実証（PoC）情報、緩和策、および技術的分析が含まれています。 📌 公開済みのCVE 1️⃣ CVE-2025-63892 — SourceCodester Student Grades Management System における格納型XSS 📄 アドバイザリ: CVE-2025-63892.md...

CVE-2025-25706

CVE-2025-25706 説明項目: root@kitploit: Product Vendor: freebsdbrasil Item: ProApps - Enterprise Appliance Editor Creator: DreamWeaver PHP: PHP Version 7.3.18 Java Script Library: Jquery UI 1.6 | Jquery 1.2.6 Server: NGINX Operational System: FreeBDS Unix 脆弱性タイプ: リモートコード実行 脆弱性の説明: この脆弱性は、ユーザーが ping...

CVE-2026-41462

🚨 CVE-2026-41462 - ProjeQtor 未認証SQLインジェクション ProjeQtor ≤ 12.4.3 における重大な未認証SQLインジェクション 📌 概要 CVE-2026-41462 は、ProjeQtor プロジェクト管理ツールのログイン機能における重大な未認証SQLインジェクションの脆弱性です。 CVE ID ：CVE-2026-41462 影響を受けるバージョン ：ProjeQtor 7.0 から 12.4.3 パッチ適用バージョン ：12.4.4 深刻度 ：緊急 CVSS 9.8 種別 ：未認証スタック型SQLインジェクション 🛠️ エクスプロイト 使用方...

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

CVE-2026-80217

A hidden functionality issue in Liteon FF-RFI079I4 and FF-RFI078I4 devices allows a user who can log in via SSH and access enable mode to execute arbitrary OS commands , leading to high impact on confidentiality, integrity, and availability (CVSS 3.0: 8.8 HIGH ). The CISA SSVC rating indicates no...

GHSA-6H8R-XR42-GP59 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

EUVD-2026-75758

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions...

CVE-2026-87958

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions...

CVE-2026-87958

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are vulnerable to a denial of service condition in which a specific server functionality can be disabled by a privileged user under certain conditions. The CVSS v3.1 score is 8.1 (HIGH) with high impact on both integrity and availab...

CVE-2026-33920

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...