647 matches found
CVE-2025-31988
HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...
CVE-2025-31988 HCL Digital Experience is susceptible to cross site scripting (XSS)
HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...
CVE-2025-31988
CVE-2025-31988 affects HCL Digital Experience. It is described as a cross-site scripting (XSS) vulnerability in an administrative UI with restricted access. Publiced technical details in connected sources show CVSS 3.1 with a Network attack vector, Low attack complexity, Privileges Required: High...
CVE-2025-31988 HCL Digital Experience is susceptible to cross site scripting (XSS)
HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...
HCL Digital Experience 安全漏洞
HCL Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL India. A security vulnerability exists in HCL Digital Experience that stems from the restricted access administrative interface being susceptible to cross-site scripting attacks...
PT-2025-33823 · Hcl · Hcl Digital Experience
Name of the Vulnerable Software and Affected Versions: HCL Digital Experience affected versions not specified Description: HCL Digital Experience is susceptible to cross-site scripting XSS within an administrative user interface that has restricted access. Recommendations: At the moment, there is...
UBUNTU-CVE-2025-53192
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue, the OGNL engine parses and evaluates the provided expression with powerful capabilities...
CVE-2025-53192
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue, the OGNL engine parses and evaluates the provided expression with powerful capabilities...
PT-2025-33061 · Unknown · Hortusfox-Web
Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS issue exists in the /Calendar endpoint of hortusfox-web version 4.4. Attackers can execute arbitrary JavaScript in a user's browser through a crafted payload injected into the...
The vulnerability of the CSV file processor in the Django web development software platform allows a hacker to execute arbitrary code.
The vulnerability of the Django web application development platform’s CSV file processor is related to an incorrect path limitation for the restricted access directory. Exploiting this vulnerability allows a malicious actor to inject arbitrary code by introducing it into a specially crafted CSV...
The vulnerability of the encode_image function in the framework for working with Large Language Models (LLM) like LlamaIndex arises from an incorrect limitation on the path name to the restricted-access catalog. This vulnerability allows attackers to disclose protected information.
The vulnerability of the encodeimage function in the LlamaIndex framework, which is used for working with large language models, is related to an incorrect restriction on the path name of the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to disclose...
The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the incorrect path name restrictions for the restricted access catalog, allowing attackers to perform spear-phishing attacks.
The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server packages is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...
The vulnerability of the setuptools project’s packaging simplification library arises from an incorrect limitation on the path to the restricted-access directory. This allows a malicious actor to compromise the vulnerable system.
The vulnerability of the setuptools project’s packaging simplification library is related to an incorrect restriction on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to compromise the vulnerable system remotely...
CVE-2025-27028
The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector CentOS 7 - VSAP 1.20 can read the entire file system content, including files belonging to other users and having restricted access like, for example, the root password hash...
PT-2025-28931 · Cloudbees +1 · Jenkins +1
Name of the Vulnerable Software and Affected Versions: Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier Description: The Jenkins Applitools Eyes Plugin stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller. Users with Item/Extended Read permission or...
The vulnerability of the CLI component of the Brocade Fabric OS operating system allows a hacker to disclose protected information.
The vulnerability of the CLI component of the Brocade Fabric OS operating system is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...
PT-2025-28139 · Utt · Utt Hiper 840G
Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue has been found in the processing of the file /goform/formPictureUrl. The manipulation of the importpictureurl argument leads to buffer overflow. This issue can be...
PT-2025-28095 · Boyuncms · Boyuncms
Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20 Description: A critical issue affects some unknown functionality of the file /application/user/controller/Index.php, where the manipulation of the image argument leads to unrestricted upload. This issue can be...