WSO2 Enterprise Integrator code injection vulnerability

The WSO2 Enterprise Integrator version 6.6.0 up to 6.6.0.205 contained a code injection vulnerability. This vulnerability stemmed from insufficient data validation for user-provided data, allowing malicious Expression Language EL code to be injected. Attackers with administrative privileges could...

IBM Cloud Pak System Cross-site Scripting Vulnerability

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 have a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting issues, which may allow users to embed arbitrary JavaScript code in the Web UI, altering intended functions and leading to the exposure of credentials in...

PT Norther Lights Production Map – SVG file upload vulnerability

PT Norther Lights Production Map: Versions prior to SVG 8.16.1 have an arbitrary file upload vulnerability. This vulnerability stems from allowing the upload of dangerous types of files, which may lead to the uploading of a Web Shell to the web server...

GIMP resource management error vulnerabilities

GIMP has a resource management vulnerability. This vulnerability arises because the XCF loader may leave empty pointers in the link channel list after the link channel’s properties are destroyed by the selection attribute. Opening a specially crafted XCF file can cause the GIMP main process to...

Red Hat Enterprise Linux Resource Management Vulnerability

Red Hat Enterprise Linux has a resource management vulnerability. This vulnerability arises when GIMP attempts to load a specially crafted XCF file by selecting a path; the loading process fails. As a result, the main process is reloaded after being released, potentially leading to a crash and...

Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability arises from the FlashPix JPEG-tile decoder, which, when processing specially crafted OLE2 FlashPix files, fails to recognize the JPEG mode and instead decodes it as a four-component JCSUNKNOWN. As a result,...

Purocean Yank Note: Path traversal vulnerability

Purocean Yank Note versions prior to 3.93.1 have a path traversal vulnerability. This vulnerability stems from issues with the path or doc parameters in the/api/help endpoint. Attackers can exploit this by providing repeated “../” segments, thereby bypassing single replacement cleanup. As a resul...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Red Hat Enterprise Linux Input Validation Vulnerability

Red Hat Enterprise Linux versions 8, 9, and 10, as well as Red Hat Hardened Images version 1, have a vulnerability in input validation. This vulnerability arises from bootc, under the default container signature policy, automatically or manually upgrading variable image tags that fall under...

Viraj Potdar Criminal-Management-System: Vulnerabilities in Permission Authorization and Access Control Mechanisms

The Viraj Potdar criminal-management-system has a security vulnerability. This vulnerability stems from improper handling of the parameter ‘myimg’ in the ‘move Uploaded File’ function within the ‘home.php’ file. As a result, arbitrary file uploads can occur, and this vulnerability may be exploite...

Progressive Robot hMailServer authorization issue vulnerability

The Progressive Robot hMailServer versions from 6.2.22 to 6.3.6, as well as from 6.0.0 to 6.3.6, have an authorization vulnerability. This vulnerability stems from the lack of authorization for Sieve notification actions and email rule responses. The server does not verify whether the sender...

Eptura Archibus arbitrary file upload vulnerability

Versions of Eptura Archibus prior to 2025.02 contained a vulnerability related to arbitrary file upload. This vulnerability stemmed from the ability of users to upload exported reports containing arbitrary file content, specify arbitrary content, and upload JSP code with JSPX as the file extensio...

Ellucian Banner Student Registration Self-Service Cross-site Scripting Vulnerability

The Ellucian Banner Student Registration Self-Service versions prior to 9.23 contain a cross-site scripting vulnerability. This vulnerability stems from the mepCode parameter in the /ssb/registration endpoint, which contains cross-site scripting. This could allow remote attackers to execute...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Pillow Resource Management Error Vulnerability

Pillow versions from 11.3.0 to 13.0.0 contain a resource management vulnerability. This vulnerability arises when the application saves TIFF tags affected by attackers to BytesIO. During the ImagingLibTiffEncode encoding process, libtiff refuses to save the tags. The error path releases the outpu...

Dell Application Store permissions and access control vulnerabilities

Versions of the Dell Application Store prior to 26.05.0.7 have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper control of path elements, which may allow low-privilege attackers with local access to escalate their privileges and execute...

MLJAR Mercury authorization issue vulnerability

The MLJAR mercury version prior to 3.2.6 has an authorization issue vulnerability. This vulnerability stems from the default lack of token deployment, allowing anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python code. Additionally, the endpoint...

Apache Camel deserialization injection vulnerability

Apache Camel versions prior to 2.11.0 through 4.18.5, as well as versions from 4.19.0 through 4.22.1, have security vulnerabilities. These vulnerabilities stem from the Apache Camel Spring Redis component using JdkSerializationRedisSerializer when a serialization option is not configured...

Dell Application Store Authorization Issues Vulnerability

Versions of the Dell Application Store prior to 26.05.0.7 have a vulnerability related to authorization. This vulnerability stems from the lack of authentication for critical functions, allowing attackers with unauthenticated access and network access rights to execute arbitrary code...

CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...