CVE-2025-36091

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment...

CVE-2025-36092 IBM Business Automation Insights improper input validation

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length...

CVE-2025-36092 IBM Business Automation Insights improper input validation

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length...

CVE-2025-36091

CVE-2025-36091 affects IBM Cloud Pak for Business Automation Core components (25.0.0, 24.0.1, 24.0.0). Description and vendor advisories identify an ownership misassignment vulnerability (CWE-283: Unverified Ownership) that could allow an authenticated user to make dashboards inaccessible to legi...

CVE-2025-36091 IBM Business Automation Insights unverified ownership

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment...

CVE-2025-63293

FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API...

PT-2025-44796

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation versions 25.0.0 through 25.0.0 Interim Fix 001 IBM Cloud Pak for Business Automation versions 24.0.1 through 24.0.1 Interim Fix 004 IBM Cloud Pak for Business Automation versions 24.0.0 through 24.0.0...

PT-2025-44768

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak For Business Automation versions 25.0.0, 24.0.1, and 24.0.0 Description An authenticated user can cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. Recommendations Update IBM Cloud P...

CVE-2025-63293

Product: FairSketch Rise Ultimate Project Manager & CRM 3.9.4. Vulnerability: Insecure Permissions in the ticketing/commenting API, allowing a remote authenticated user to append comments or upload attachments to tickets they should not view/edit due to missing authorization checks. Impact (per s...

Lenovo Tablets 安全漏洞

Lenovo Tablets is a line of tablet computers from the Chinese company Lenovo Lenovo. A security vulnerability exists in Lenovo Tablets that originates from a locally authenticated user or application that could access sensitive device-specific information...

PT-2025-44769

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak For Business Automation versions 25.0.0, 24.0.1, and 24.0.0 Description IBM Cloud Pak For Business Automation may allow an authenticated user to cause a denial of service. This is due to improper validation of input length...

Astra Linux – Vulnerability in Intel Microcode

The sequence of processor instructions may lead to unexpected behavior in some IntelR XeonR 6 Scalable processors. It is possible for a authenticated user to potentially enable privilege escalation through local access...

CVE-2025-11755

The CVE-2025-11755 entry concerns the WP Delicious – Recipe Plugin for WordPress (formerly Delicious Recipes) with vulnerable CSV import handling up to version 1.9.0. Connected sources confirm an Authenticated (Contributor+) Arbitrary File Upload flaw: an attacker with low privileges can supply a...

CVE-2016-15050

Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries...

CVE-2012-10063

Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager CCM interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in th...

CVE-2018-25122

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inje...

CVE-2013-10073

Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary...

CVE-2020-36863

Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An...

CVE-2024-14004

Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling nagvis.conf. An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the...

EUVD-2025-37400

ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow...