779 matches found
VulnCheck KEV: CVE-2025-1302
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...
CVE-2025-55074 Channel member objects leak read status
Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects...
CVE-2024-48829
Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code 'Code Injection' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...
Ozeki SMS Gateway 安全漏洞
Ozeki SMS Gateway is an SMS gateway from Ozeki UK. A security vulnerability exists in Ozeki SMS Gateway version 10.3.208 and earlier, which stems from a path traversal issue that could lead to the disclosure of sensitive information...
CVE-2025-43990
Dell Command Monitor DCM, versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
EUVD-2025-36565
DNN vulnerable to stored cross-site-scripting XSS via SVG upload...
CVE-2025-64216
CVE-2025-64216 is a Local File Inclusion vulnerability in WordPress theme SmartMag (versions
CVE-2025-64216 WordPress SmartMag theme <= 10.3.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion.This issue affects SmartMag: from n/a through = 10.3.0...
CVE-2025-49042 WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through = 10.0.2...
CVE-2025-62802 DNN CKEditor Provider allows unauthenticated upload out-of-the-box
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...
Zimbra Collaboration 10.1.x < 10.1.5 Stored Cross-Site Scripting
According to its banner, the version of Zimbra Collaboration running on the remote host is 10.0.x prior to 10.0.13 or 10.1.x prior to 10.1.5. It is, therefore, affected by a Stored Cross-Site Scripting XSS vulnerability due to insufficient sanitization of HTML content in ICS files. Note that the...
GHSA-XR3W-RMVJ-F6M7 Mattermost has an Observable Timing Discrepancy vulnerability
Mattermost versions 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets...
CVE-2025-41443 Guest user can discover active public channels
Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...
CVE-2025-41443 Guest user can discover active public channels
Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...
Security Bulletin: IBM Transformation Extender Advanced is affected by unsafe Java deserialization.
Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by unsafe Java deserialization. Vulnerability Details CVEID:CVE-2023-49886 DESCRIPTION: IBM Standards Processing Engine could allow a remote attacker to execute arbitrary code on the system,...
OpenSSH 安全漏洞
OpenSSH OpenBSD Secure Shell is a Canadian OpenBSD open source set of connection tools for secure access to remote computers. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection hijacking, and...
IBM Security Verify Access和IBM Security Verify Access Docker 操作系统命令注入漏洞
IBM Security Verify Access ISAM and IBM Security Verify Access Docker are both products of International Business Machines IBM.IBM Security Verify Access is a service that improves the security of user access.IBM Security Verify Access Docker is a service that can be used to configure a Security...
PT-2025-51828
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.4 Description The application does not properly validate redirect URLs on the /error page. This allows an attacker to redirect a victim to a malicious site by crafting a link that, when opened in a new...