1727 matches found
CVE-2025-4971 Broadcom Automic Automation Agent Unix privilege escalation
Broadcom Automic Automation Agent Unix versions 24.3.0 HF4 and 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges...
CVE-2025-35471
conda-forge openssl-feedstock before 066e83c 2024-05-20, on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary co...
PT-2025-20824 · Conda Forge +2 · Conda-Forge Openssl-Feedstock +2
Name of the Vulnerable Software and Affected Versions: conda-forge openssl-feedstock versions before 066e83c 2024-05-20 Miniforge versions before 24.5.0 Description: The issue concerns a configuration in conda-forge openssl-feedstock on Microsoft Windows, where OpenSSL uses an OPENSSLDIR file pat...
CVE-2025-46571
CVE-2025-46571 affects Open WebUI prior to version 0.6.6. Low-privileged users could upload HTML files containing JavaScript via the backend endpoint /api/v1/files/, which returns a file id. An attacker could lure an admin to click a link to such a file, causing the JavaScript to execute in the a...
CVE-2025-46571 Open WebUI vulnerable to limited stored XSS vila uploaded html file
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...
CVE-2025-46571 Open WebUI vulnerable to limited stored XSS vila uploaded html file
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...
PT-2025-19772
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...
CVE-2025-46690
Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request...
PT-2025-18020 · Ververica · Ververica Platform
Name of the Vulnerable Software and Affected Versions: Ververica Platform version 2.14.0 Description: The issue allows low-privileged users to access SQL connectors via a direct "namespaces/default/formats" request. Recommendations: For Ververica Platform version 2.14.0, consider restricting acce...
PT-2025-17870 · Unknown · Sherpa Orchestrator
Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: A low-privileged user can elevate their privileges by creating new users and roles. Recommendations: For Sherpa Orchestrator version 141851, consider restricting the ability of low-privileged...
The vulnerability of the SafeInspect system for privileged users stems from the lack of measures taken to protect the structure of the web page. This allows a perpetrator to execute arbitrary HTML code.
The vulnerability of the SafeInspect privilege user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to execute arbitrary HTML code remotely...
The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the SafeInspect privilege-controlled user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary JavaScript code...
The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the SafeInspect privilege control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code during the user creation process...
PT-2025-16592 · Symfonia · Ready
Name of the Vulnerable Software and Affected Versions: Ready affected versions not specified Description: The issue arises from the improper neutralization of user input in a file search function within the invoices module, allowing for SQL Injection attacks. This can be exploited by a...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...
Privilege Escalation
github.com/rancher/rancher is vulnerable to Privilege Escalation. The vulnerability is due to improper access control that allows Restricted Administrators to change the passwords of higher-privileged users without having the Manage Users permission...
CVE-2025-32383
MaxKB (Max Knowledge Base) has a reverse shell vulnerability in the function library module that could allow privileged users to create a reverse shell. The issue is fixed in version 1.10.4-lts. Affected software is MaxKB; root cause details are not elaborated in the provided documents. Remediati...
CVE-2025-25023
IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment...
HGiga PowerStation 安全漏洞
HGiga PowerStation is a network load balancing system from China Henderson HGiga. A security vulnerability exists in HGiga PowerStation, which stems from a chroot restriction bypass that could lead to privileged users accessing the entire file system...