9710 matches found
CVE-2021-44002
A vulnerability has been identified in JT Open All versions V11.1.1.0, JT Utilities All versions V13.1.1.0, Solid Edge All versions V2023. The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker t...
CVE-2021-35242
Serv-U server responds with valid CSRFToken when the request contains only Session...
CVE-2006-2371
creationtimestamp| type| source ---|---|--- 2025-02-06 03:13:38+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:08:16+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd...
CVE-2025-23711
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Quincy Kwende Quote me quote-me allows Reflected XSS.This issue affects Quote me: from n/a through = 1.0...
CVE-2022-25737
Information disclosure in modem due to missing NULL check while reading packets received from local network...
CVE-2025-23217
creationtimestamp| type| source ---|---|--- 2025-02-06 01:34:24+00:00| seen| https://bsky.app/profile/hi.ls/post/3lhhwyw4vzs2d 2025-02-06 17:54:47+00:00| seen| https://infosec.exchange/users/cve/statuses/113958223039348997 2025-02-06 18:16:39+00:00| seen|...
CVE-2022-21346
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware component: BI Publisher Security. Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...
CVE-2022-21676
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io...
CVE-2022-3861
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...
CVE-2022-47411
An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations...
CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps...
CVE-2025-22936
The Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router (models SAM-4G1G-TT-W-VC and SAM-4F1F-TT-W-A1 ) is vulnerable to a security flaw where a weak default WiFi password generation algorithm allows a remote attacker to obtain sensitive information. An attacker can exploit this to gain access t...
CVE-2025-1010
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...
One Identity Manager IDOR Privilege Escalation
The vulnerability of the User Identification, Access Rights, and Security Policies management tool, One Identity Manager, is related to an insecure direct reference to an object IDOR due to a bypass of authentication using data that are assumed to be immutable. Exploiting this vulnerability can...
CVE-2022-36051
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...
CVE-2022-27835
Improper boundary check in UWB firmware prior to SMR Apr-2022 Release 1 allows arbitrary memory write...
CVE-2024-38316
CVE-2024-38316 affects IBM Aspera Shares 1.9.0–1.10.0 PL6, where an authenticated user’s ability to send emails is not properly rate-limited, potentially enabling email flooding and denial of service. The IBM Security Bulletin describes the vulnerability (CWE-770: Allocation of Resources Without ...
CVE-2024-57084
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...