mysql: Client programs unspecified vulnerability (CPU Oct 2024)

Vulnerability in the MySQL Server product of Oracle MySQL component: Client programs. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to...

mysql: X Plugin unspecified vulnerability (CPU Oct 2024)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

mysql: MySQL Server: Denial of Service vulnerability

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56882

Sage DPW versions prior to 2024_12_000 are vulnerable to Cross Site Scripting (XSS) . The root cause is the unfiltered scripting of specific input fields, allowing low-privileged users with employee role privileges to permanently store malicious JavaScript code in the Kurstitel and Kurzinfo field...

CVE-2024-56883

Sage DPW, an HR system from Sage UK, is vulnerable to Incorrect Access Control in versions prior to 2024_12_001 . The root cause is a failure to consistently enforce role-based access controls on the server side. Specifically, low-privileged users with employee role privileges can bypass UI restr...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2025-0592

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device...

CVE-2025-0593

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device...

CVE-2025-0593

CVE-2025-0593 affects SICK Lector8xx and SICK InspectorP8xx. A remote, low-privilege attacker can cause the device to run arbitrary shell commands by using lower-level functions to interact with the hardware. Several sources identify the affected products and note the vulnerability exists in olde...

CVE-2025-0593 SICK Lector8xx and InspectorP8xx vulnerable for code execution

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device...

CVE-2025-0592

CVE-2025-0592 affects SICK Lector8xx and SICK InspectorP8xx devices. Multiple connected sources indicate a remote, low-privilege attacker can execute arbitrary shell commands by manipulating firmware files and uploading them to the device. Reported affected versions include SICK Lector8xx prior t...

CVE-2025-26367

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to create arbitrary user groups via crafted HTTP requests...

CVE-2025-26378

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests...

CVE-2025-26368

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to remove user groups via crafted HTTP requests...

CVE-2025-26377

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to remove users via crafted HTTP requests...

CVE-2025-26371

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to add users to groups via crafted HTTP requests...