CVE-2025-22220

VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2024-12709

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12709

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-54852

Teedy CVE-2024-54852 affects Teedy versions 1.9–1.12. The LDAP injection arises from improper sanitization of the username field in the LDAP login flow, enabling an unauthenticated attacker to perform actions such as creating arbitrary accounts and spraying passwords. Remediation: update LDAP han...

CVE-2024-54852

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary...

CVE-2025-23054 Authenticated Response Manipulation allows Unauthorized Actions in Management Interface

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files,...

CVE-2025-23054

CVE-2025-23054 affects the web-based management interface of HPE Aruba Networking Fabric Composer. It describes an authenticated low-privilege operator who can perform operations outside their privilege level, potentially leading to manipulation of user-generated files and unauthorized changes to...

Cross-Site Request Forgery (CSRF)

codechecker is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper authentication handling in CodeChecker, which allows an attacker to hijack the authentication of a logged-in user and perform actions with the same permissions...

The vulnerability in the net_openvswitch/actions.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the netopenvswitch/actions.c component of the Linux kernel relates to reading data from the buffer beyond its allowable limits. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-22316 IBM Sterling File Gateway improper access control

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user's data due to improper access controls...

CVE-2024-22316

CVE-2024-22316 affects IBM Sterling File Gateway versions 6.0.0.0–6.1.2.5 and 6.2.0.0–6.2.0.1, where an authenticated user could perform unauthorized actions on another user’s data due to improper access controls. The Red Hat advisory confirms the same vulnerability and lists affected versions wi...

CVE-2024-12436

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12436

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-57373

Cross Site Request Forgery CSRF vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of an authenticated user, potentially leading to account modifications or data compromise...

CVE-2024-41739

IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion...

CVE-2024-41739

IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion...

PT-2025-5451 · Pickplugins · Pickplugins Job Board Manager

Name of the Vulnerable Software and Affected Versions: PickPlugins Job Board Manager versions 2.1.59 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the PickPlugins Job Board Manager, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For...

PT-2025-5514 · Unknown · G5Theme Essential Real Estate

Name of the Vulnerable Software and Affected Versions: G5Theme Essential Real Estate versions 5.1.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 5.1.8 and...

PT-2025-2608 · Ibm · Ibm Cognos Dashboards

Name of the Vulnerable Software and Affected Versions: IBM Cognos Dashboards versions 4.0.7 through 5.0.0 Description: The issue is related to dependency confusion, allowing a remote attacker to perform unauthorized actions. This could potentially lead to privilege escalation. Recommendations: Fo...