1036 matches found
CVE-2025-57879 BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...
PT-2025-39858
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description A reflected cross site scripting issue exists in Esri Portal for ArcGIS. A remote attacker with administrative access can inject a crafted string to execute arbitrary JavaScript code i...
PT-2025-39807
Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0 Description A path traversal issue exists in Bjskzy Zhiyou ERP. The uploadStudioFile function within the com.artery.form.services.FormStudioUpdater component is affected. Manipulation of the filepath...
Bjskzy Zhiyou ERP 代码问题漏洞
Bjskzy Zhiyou ERP is an Enterprise Resource Planning software from Bjskzy Beijing, China. A code issue vulnerability exists in Bjskzy Zhiyou ERP version 11.0 and prior versions, which stems from the incorrect manipulation of the parameter contentString of the function openForm in the component...
PT-2025-39809
Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0 Description A flaw exists in Bjskzy Zhiyou ERP that could allow for remote manipulation. The issue is related to the openForm function within the com.artery.richclient.RichClientService component...
PT-2025-39862
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description A reflected cross site scripting issue exists that could allow a remote authenticated attacker with administrative access to execute arbitrary JavaScript code in the browser by supplyi...
Esri Portal For ArcGIS 跨站脚本漏洞
Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal for ArcGIS version 11.4 and earlier, which stems from a remote...
CVE-2025-59936
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
CVE-2025-36326 IBM Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies...
CVE-2025-36037
IBM webMethods Integration Server (on‑prem) versions 10.15 and 11.1 are affected by a server‑side request forgery (SSRF) vulnerability (CVE-2025-36037). The issue allows an authenticated attacker to cause unauthorized requests from the server, potentially enabling network enumeration. Remediation...
CVE-2025-9983
The CVE-2025-9983 affects GALAYOU G2 IP cameras, where RTSP streams can be accessed without valid credentials. The issue arises because default credentials are not required to access streams, and changing them does not affect behavior, indicating an authentication bypass in the RTSP service. Affe...
IBM webMethods Integration 格式化字符串错误漏洞
IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A Formatting String Error vulnerability exists in IBM webMethods Integration versions 10.15 and 11.1, which stems from improper validation of parameter formatting strings passed to an external source...
DEBIAN-CVE-2023-53237
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuirqput call trace in gmcv110hwfini The gmc.eccirq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpuirqput...
TYPO3 CSV download feature information disclosure
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them...
CVE-2025-58454
CVE-2025-58454 affects WeGIA Web Manager (charities). A SQL injection exists in the endpoint /WeGIA/html/memorando/listar_despachos.php, parameter id_memorando, for versions
python3.11 security update
An update is available for python3.11. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming languag...
Linux Distros Unpatched Vulnerability : CVE-2019-17561
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache NetBeans autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. Apache...
SUSE-SU-2025:02979-1 Security update for tomcat11
This update for tomcat11 fixes the following issues: Updated to Tomcat 11.0.9 - CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload bsc1246388 - CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability bsc1246318...
Bjskzy Zhiyou ERP 安全漏洞
Bjskzy Zhiyou ERP is an enterprise resource planning software from Beijing, China-based Bjskzy Zhiyou Bjskzy. A security vulnerability exists in Bjskzy Zhiyou ERP version 11.0 and earlier, which originates from SQL injection due to incorrect manipulation of the parameter sql in the...
