11427 matches found
yimioa security vulnerabilities
yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from improper access control of the WebSecurityConfig component and allows an unauthorized attacker to arbitrarily change the...
Expr security vulnerabilities
Expr is an expression language and expression evaluation for Go open-sourced by Expr. A security vulnerability exists in versions of Expr prior to 1.17.0, which stems from an unlimited input size that could lead to memory exhaustion...
Several products of China Mobile have security vulnerabilities
China Mobile P22g-CIac and others are an IoT enterprise gateway from China Mobile China, a Chinese company. A security vulnerability exists in various China Mobile products, which stems from improper authorization. The following products and versions are affected: China Mobile P22g-CIac,...
PT-2026-7964
Name of the Vulnerable Software and Affected Versions Vnet/IP Interface Package versions R1.07.00 and earlier Description A flaw exists in the Vnet/IP Interface Package that could allow a denial-of-service DoS attack. Receiving maliciously crafted packets may cause Vnet/IP communication functions...
CVE-2025-25175
A vulnerability has been identified in Simcenter Femap V2401 All versions V2401.0003, Simcenter Femap V2406 All versions V2406.0002. The affected application contains a memory corruption vulnerability while parsing specially crafted .NEU files. This could allow an attacker to execute code in the...
Issuetrak security vulnerabilities
Issuetrak is an issue tracking software from Issuetrak, Inc. A security vulnerability exists in Issuetrak v17.2.2 and prior versions, which stems from an insecure direct object reference in the auditing component that could lead to a low-privileged user accessing another user's audit results,...
CVE-2025-27794
Summary: CVE-2025-27794 affects Flarum versions prior to 1.8.10, where an attacker-controlled authoritative subdomain can set cookies for the parent domain, potentially enabling session hijacking on sibling subdomains. What is affected: Flarum core (pre-1.8.10) with cookies scoped to a parent dom...
WordPress plugin BlogBuzzTime for WP cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
CVE-2025-27101 Broken Access Control in Opal filesystem's copy functionality exposes all user data
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...
UBUNTU-CVE-2025-25749
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies...
Babel security vulnerabilities
Babel is a compiler for JavaScript in the Babel open source. A security vulnerability exists in Babel versions prior to 7.26.10 and prior to 8.0.0-alpha.17, which stems from a .replace method generated when compiling regular expression named capture groups that has a quadratic complexity on certa...
Fortinet FortiNDR Cross-Site Request Forgery Vulnerability
Fortinet FortiNDR is a network detection and response solution from Fortinet, Inc. A cross-site request forgery vulnerability exists in Fortinet FortiNDR, which stems from a cross-site request forgery that could lead to the execution of an unauthorized operation. The following versions are...
AZL-58372 CVE-2025-1920 affecting package nodejs18 18.20.3-11
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2025-20922
Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...
CVE-2025-26331
Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...
Sage 200 Spain security vulnerabilities
Sage 200 Spain is a business management software from Sage. A security vulnerability exists in Sage 200 Spain versions prior to 2025.35.000, which stems from a Pass-Back vulnerability that could lead to the discovery of stored SMTP credentials by a privileged administrator user...
I-net Software HelpDesk: Vulnerabilities in Trust Management
I-net Software HelpDesk is a suite of service management helpdesk software from I-net Software, Germany. A trust management issue vulnerability exists in I-net Software HelpDesk versions prior to 3.3.3 that stems from improper certificate validation, which could allow a remote attacker to...
Backdrop CMS cross-site scripting vulnerabilities
Backdrop CMS is a content management system CMS from Backdrop CMS open source. A cross-site scripting vulnerability exists in Backdrop CMS versions prior to 1.x-1.1.1, which stems from insufficient input cleanup and could lead to cross-site scripting attacks...
Python JSON Logger security vulnerabilities
Python JSON Logger is a JSON formatting tool for Python logs by the individual developer Nicholas Hairs. A security vulnerability exists in Python JSON Logger versions prior to 3.3.0, which stems from a missing dependency that could lead to remote code execution...