1064 matches found
EUVD-2004-2436
Malicious code in bioql PyPI...
GHSA-8C8V-R5JJ-4425 Liferay Contacts Center widget has insecure direct object reference
Insecure direct object reference IDOR vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows...
Enalean Tuleap Community Edition和Enalean Tuleap Enterprise Edition 安全漏洞
Enalean Tuleap Community Edition and Enalean Tuleap Enterprise Edition are both an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A security vulnerability exists in Tuleap Community Edition version 16.11.99.1757427600 and...
CVE-2025-43203
The issue was addressed with improved handling of caches. This issue is fixed in iOS 26 and iPadOS 26, iOS 18.7 and iPadOS 18.7. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note...
CVE-2025-43203
The issue was addressed with improved handling of caches. This issue is fixed in iOS 26 and iPadOS 26, iOS 18.7 and iPadOS 18.7. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note...
CVE-2025-43797
In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Memos Vulnerable to Stored Cross-Site Scripting
Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...
PT-2025-36030
Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A missing permission check may allow a user to view icons belonging to another user, potentially leading to local information disclosure. User interaction is not required for exploitation...
Linux Distros Unpatched Vulnerability : CVE-2021-20283
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each...
CVE-2025-56761
Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...
PT-2025-35709
Name of the Vulnerable Software and Affected Versions: versions not specified Description: Users with webhook permissions can conduct Server-Side Request Forgery SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed. This allows...
CVE-2025-55944
CVE-2025-55944 concerns Slink v1.4.9, where stored XSS can be triggered by crafted SVG uploads. The vulnerability arises when a user views the shared image in a new tab, allowing embedded JavaScript to execute for both authenticated and unauthenticated users. Technical specifics across connected ...
Linux Distros Unpatched Vulnerability : CVE-2021-40695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was possible for a student to view their quiz grade before it had been released, using a quiz web service. CVE-2021-40695 Note that Nessus relies on the...
CVE-2025-22416
In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-22416
CVE-2025-22416 affects Android’s ChooserActivity.java onCreate, enabling a confused deputy to view other users’ images and cause local privilege escalation without extra privileges or user interaction. Public references note it as an Elevation of Privilege issue (High) in the Android 2025-04 secu...
ASB-A-366403307
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2025-34978
Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: An improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists. This allows a remote, unauthenticated attacker to view...
BIT-MOODLE-2025-26526 Feedback response viewing and deletions did not respect Separate Groups mode
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities...