19060 matches found
CVE-2025-0193: Improper Neutralization of Input During Web Page Generation
A stored Cross-site Scripting XSS vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability...
CVE-2024-50858
Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...
CVE-2024-55921 Cross-Site Request Forgery in Extension Manager Module in TYPO3
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...
CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...
CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...
CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper
Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...
Description of the security update for SharePoint Enterprise Server 2016: January 14, 2025 (KB5002672)
Description of the security update for SharePoint Enterprise Server 2016: January 14, 2025 KB5002672 Applies To SharePoint Server 2016 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server spoofing vulnerability. To...
GHSA-8MV3-37RC-PVXJ TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...
TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...
PT-2025-4761 · Linksys · Linksys E5600 Router
Name of the Vulnerable Software and Affected Versions: Linksys E5600 Router version 1.1.0.26 Description: A stored cross-site scripting XSS issue in the prf table content component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter. Th...
Security Bulletin: IBM Engineering Lifecycle Management is impacted by vulnerabilities in Apache Jena
Summary A vulnerability has been identified in Apache Jena - jena-core-2.7.1.jar, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2021-39239 DESCRIPTION: Apache...
CISA: Actions to Improve Chemical Facility Safety and Security - a Shared Commitment (Report for the President, May 2014)
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CVE-2025-23111
An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website...
CVE-2024-47520
A user with advanced report application access rights can perform actions for which they are not authorized...
CVE-2024-47520
A user with advanced report application access rights can perform actions for which they are not authorized...
CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized
A user with advanced report application access rights can perform actions for which they are not authorized...
CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized
A user with advanced report application access rights can perform actions for which they are not authorized...
CVE-2024-47520
Summary of CVE-2024-47520 (Arista NGFW/ETM): A user with advanced reporting application access rights can perform actions beyond authorization. Documented as part of Arista Security Advisory 0105, the issue is tied to the reporting component and allows privilege misuse by users with limited admin...
Denial Of Service (DoS)
Next.js is vulnerable to a Denial of Service DoS. The vulnerability is due to requests to Server Actions hanging indefinitely, causing the server to remain idle with the connection open, allows an attacker to keep the connection open until the hosting provider cancels the function, leading to...