6755 matches found
PT-2025-1940 · WordPress · Aklamator Infeed
Name of the Vulnerable Software and Affected Versions: Aklamator INfeed WordPress plugin versions through 2.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This coul...
CVE-2025-20123
Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based...
Cross-site Scripting (XSS)
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS in ckeditor5.js, which does not sufficiently isolate ckeditor rich text objects. A user with the ability to input long tex...
PT-2025-20833
Name of the Vulnerable Software and Affected Versions: GNUScreen version 5.0.1 and earlier Description: The issue affects Linux administrators, cloud engineers, and developers. It is related to a root privilege escalation flaw. Recommendations: For versions prior to 5.0.1, update to version 5.0.1...
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation
Cybersecurity researchers have uncovered three security weaknesses in Microsoft's Azure Data Factory Apache Airflow integration that, if successfully exploited, could have allowed an attacker to gain the ability to conduct various covert actions, including data exfiltration and malware deployment...
PT-2024-17757 · Cgfido · Cgfido
Name of the Vulnerable Software and Affected Versions: CGFIDO affected versions not specified Description: The passwordless login mechanism in CGFIDO has an Authentication Bypass issue, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-50702
TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...
CVE-2024-46542
CVE-2024-46542 affects Veritas / Arctera Data Insight versions prior to 7.1.1. The root cause is improper neutralization of SQL commands, allowing Application Administrators to perform SQL injection. Impact described: potential information disclosure. Remediation: upgrade to 7.1.1 or later; as a ...
PT-2024-36337 · Kurmi · Kurmi Provisioning Suite
Name of the Vulnerable Software and Affected Versions: Kurmi Provisioning Suite versions 7.9.0.38 and earlier Kurmi Provisioning Suite versions 7.10.x through 7.10.0.18 Kurmi Provisioning Suite versions 7.11.x through 7.11.0.15 Description: A cross-site scripting XSS vulnerability in the...
CVE-2024-37773
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen...
PT-2024-15970 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress WordPress plugin versions prior to 4.2.7.2 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize a...
PDQ Deploy allows reuse of deleted credentials that can compromise a device and facilitate lateral movement
Overview PDQ Deploy is a service intended for usage by system administrators for the deployment of software or updates to targeted machines within their network. PDQ Deploy uses "run modes" to deploy software to their target devices. The run mode "Deploy User" insecurely creates credentials on th...
CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...
CVE-2024-53284
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect Setting functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...
CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...
py-matrix-synapse -- multiple vulnerabilities in versions prior to 1.120.1
element-hq/synapse developers report: The 1.120.1 release fixes multiple security vulnerabilities, some affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild...