CVE-2024-32119

CVE-2024-32119 affects Fortinet FortiClientEMS, specifically versions 7.4.0 and before 7.2.4. The issue is an improper authentication (CWE-287) that could allow an unauthenticated attacker, who knows a targeted user’s FCTUID and VDOM, to perform operations such as uploading or tagging on behalf o...

BIT-MARIADB-MIN-2021-2389

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server...

BIT-MARIADB-MIN-2021-2007

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

BIT-MARIADB-MIN-2020-2922

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

CVE-2025-41657

Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker...

CVE-2025-41657 AUMA: Incorrect delivery status of the Bluetooth configuration

Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker...

CVE-2025-42988

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...

CVE-2025-31325

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver ABAP Keyword Documentation, an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the...

CVE-2025-23192

SAP BusinessObjects Business Intelligence BI Workspace allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session...

CVE-2025-31325

SAP NetWeaver ABAP Keyword Documentation is affected by a Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject JavaScript into a vulnerable page via an unprotected parameter, causing the script to run in the victim's browser and potentially access restricted informatio...

CVE-2025-31325 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver ABAP Keyword Documentation, an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the...

SAP BusinessObjects Business Intelligence 跨站脚本漏洞

SAP BusinessObjects Business Intelligence is an enterprise-class business intelligence solution from SAP. SAP BusinessObjects Business Intelligence suffers from a cross-site scripting vulnerability that originates from an unauthenticated attacker who can store malicious scripts, which can be...

CVE-2025-23192: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence BI Workspace allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session...

PT-2025-24583 · Sap · Sap Businessobjects Business Intelligence

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence BI Workspace affected versions not specified Description: The issue allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, t...

Fortinet Fortigate Firewall session injection in FGSP (FG-IR-24-287)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-287 advisory. - An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 throug...

PT-2025-24710 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.13 Fortinet FortiOS versions 7.2.0 through 7.2.7 Fortinet FortiOS versions 7.4.0 through 7.4.3 Fortinet FortiProxy versions 7.0.0 through 7.0.15 Fortinet FortiProxy versions 7.2.0 through 7.2.9...

PT-2025-24590

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform affected versions not specified Description The issue allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by manipulating specific HTTP requests. This...

CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The setremote function later passes this input into procopen, yielding OS...

Exploit for Stack-based Buffer Overflow in Ivanti Connect_Secure

Blackash-CVE-2025-0282 Description A stack-based buffer ov...

CVE-2025-20273

A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This...