EUVD-2026-5036

Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization...

CVE-2025-63562

The CVE describes a vulnerability in Summer Pearl Group Vacation Rental Management Platform prior to version 1.0.2 where server-side authorization is insufficient. Authenticated attackers can manipulate request parameters (e.g., owner or resource id) to call endpoints and perform create, update, ...

EUVD-2018-3485

Malware in sbrugna...

EUVD-2020-0103

Malware in sbrugna...

CVE-2020-2281

A cross-site request forgery CSRF vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources...

CVE-2025-32080

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43...

CVE-2025-32080

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43...

MediaWiki 信息泄露漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia Foundation in the United States. The product can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki - Mobile Frontend Extension...

The vulnerability of the HFSPlus file system driver of the Grub2 operating system allows a attacker to trigger a service failure.

The vulnerability of the HFSPlus file system driver of the Grub2 operating system is related to improper manipulation of the link counter for resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-39420

Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises...

Code injection

A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed ...

Stored HTML injection

Description Stored HTML Injection: A Hidden Web Threat. Learn how attackers exploit input fields to inject malicious code into web applications, jeopardizing user data and site integrity. Discover crucial prevention measures to safeguard against this insidious vulnerability. Step to reproduce 1...

CVE-2023-35936 Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

PT-2023-10112 · Unknown · Networkmanager

Name of the Vulnerable Software and Affected Versions: vicamo NetworkManager affected versions not specified Description: A vulnerability was found in vicamo NetworkManager, affecting the function nm setting vlan add priority str/nm utils rsa key encrypt/nm setting vlan add priority str. The...

GHSA-JX7V-GMQC-6XRJ OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

OpenStack Manila =8.0.0 =9.0.0 9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks...

CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, includin...

CVE-2020-9543

OpenStack Manila =8.0.0 =9.0.0 9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks...

CVE-2020-9543

CVE-2020-9543 affects OpenStack Manila (versions listed in the OpenStack Manila advisories). The issue arises from a context-free lookup of a UUID, allowing unprivileged attackers to view, update, delete, or share resources that do not belong to them, and potentially create resources such as shar...

CVE-2018-11454

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V10, V11, V12 All versions, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V13 All versions V13 SP2 Update 2, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V14 All versions V14 SP1 Update 6, SIMATIC STEP 7 TIA...

Cross Namespace Escalation

github.com/kubernetes/kubernetes is vulnerable to cross namespace escalation attacks. A malicious user can submit a HPA request against another namespace that they have no permissions on and use it to manipulate resources...