6846 matches found
CVE-2025-1330
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyname function...
CVE-2025-26845
An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script...
CVE-2025-36546
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability they must obtain the root user's SSH...
CVE-2025-36546
CVE-2025-36546 affects F5OS (Aplpliance mode) where SSH key-based login remains allowed for the root user even after Appliance Mode is enabled, enabling potential unauthorized access if an attacker possesses the root SSH private key. The F5 advisories/Red Hat/NCSC entries describe the issue as a ...
CVE-2025-3844
CVE-2025-3844 concerns the PeproDev Ultimate Profile Solutions plugin for WordPress. Affected versions 1.9.1–7.5.2 are vulnerable to an Authentication Bypass via the handel_ajax_req() path on change_user_meta, enabling unauthenticated attackers to log in as other users (including administrators)....
Moodle Information Disclosure Vulnerability
Moodle is a free e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from an insufficient capability check, which can be exploited by an attacker ...
Ensure That Different Group IDs Are Initially Assigned to Different Users
The initial login groups of different users must be different. If a user needs to access files in another group, you need to run a command to add the user to the group. In most cases, if the file permission and the folder permission are set to 640 and 750, respectively, users in the same group ca...
Unspecified Vulnerability in Moodle
Moodle is a free e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from the need for additional checks to ensure that users only have access to authorized grou...
CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass
A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...
CVE-2025-4318
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...
CVE-2025-4318
CVE-2025-4318 affects the package aws-amplify/amplify-codegen-ui used with AWS Amplify Studio. The vulnerability is described as a lack of input validation in UI component property expressions, which could allow an authenticated user with access to create or modify components to execute arbitrary...
PT-2025-19796 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b Description: A data leak issue affects Discourse, an open-source community platform, allowing some content on the site's homepage to be visible to...
PT-2025-18932 · WordPress · Verticalresponse Newsletter Widget
Name of the Vulnerable Software and Affected Versions: VerticalResponse Newsletter Widget plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode due to insufficient input sanitization a...
CVE-2024-13859
The vulnerability CVE-2024-13859 affects the BuddyBoss Platform WordPress plugin (versions up to and including 2.8.50). Root cause: insufficient input sanitization and output escaping in the bp_nouveau_ajax_media_save function, enabling authenticated attackers with Subscriber-level access or high...
BIT-MOODLE-2024-43435 Moodle: can create global glossary without being admin
A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary...
PT-2025-18367 · WordPress · The Team Members – Best Wordpress Team Plugin
Name of the Vulnerable Software and Affected Versions: The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress versions up to, and including, 3.4.0 Description: The issue is related to Stored Cross-Site Scripting via Social Link icons due ...
PT-2025-18384 · WordPress · Wordpress Simple Shopping Cart
Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to, and including, 5.1.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wp cart button' shortcode due to insufficient input sanitization and output escaping...
PT-2025-18359 · WordPress · List Children
Name of the Vulnerable Software and Affected Versions: The List Children plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'list children' shortcode due to insufficient input sanitization and output escaping o...
Amazon Linux 2 : kernel (ALAS-2025-2834)
The version of kernel installed on the remote host is prior to 4.14.330-250.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2834 advisory. A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this...