Microsoft Purview Information Disclosure Vulnerability

A Server-Side Request Forgery SSRF vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network...

CVE-2025-21385: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network...

Microsoft Azure Marketplace SaaS 访问控制错误漏洞

Microsoft Azure Marketplace SaaS is a marketplace software from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Azure Marketplace SaaS that stems from improper access control and allows an authorized attacker to disclose information over the network...

CVE-2024-11713

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'pageid' parameter of the wpjobportaldeactivate function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...

CVE-2024-41151: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

CVE-2024-45505: Improper Neutralization of Special Elements used in a Command

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache HertzBeat incubating. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat incubating: before 1.6.1. Users are recommended to upgrade to versi...

CVE-2024-38204

Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network...

Imagine Cup site Information Disclosure Vulnerability

Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network...

PT-2024-7116 · Microsoft · Dataverse

Name of the Vulnerable Software and Affected Versions: Microsoft Dataverse affected versions not specified Description: The issue is related to improper authentication in Microsoft Dataverse, allowing an authorized attacker to elevate privileges over a network. This can potentially lead to...

CVE-2024-43614

Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally...

PT-2024-80: Reflected Cross-Site Scripting (XSS) in Netcat CMS (comments module)

The vulnerability was identified in Netcat comments module, version 6.4 Extra. The discovered vulnerability allows an authorized attacker with the administrator role to execute arbitrary JavaScript code in the browser of the attacked user. Vulnerability status: Confirmed by vendor Date of...

CVE-2024-25946: Improper Neutralization of Special Elements used in an OS Command

Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity...

CVE-2024-25955: Improper Neutralization of Special Elements used in an OS Command

Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity...

PT-2024-2772 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.4 Description: The issue is related to a Cross-site scripting vulnerability. An authenticated attacker could potentially exploit this vulnerability, stealing session information, masquerading as the affected use...

CVE-2023-37518

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user...

Code injection

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user...

CVE-2023-37518 A code injection vulnerability affects HCL BigFix ServiceNow Data Flow

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user...

CVE-2023-41365

SAP Business One B1i - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no...

CVE-2020-19318: Out-of-bounds Write

Buffer Overflow vulnerability in D-Link DIR-605L, hardware version AX, firmware version 1.17beta and below, allows authorized attackers execute arbitrary code via sending crafted data to the webserver service program...

Command injection

A command injection vulnerability in RG-EW series home routers and repeaters v.EW3.01B11P219, RG-NBS and RG-S1930 series switches v.SWITCH3.01B11P219, RG-EG series business VPN routers v.EG3.01B11P219, EAP and RAP series wireless access points v.AP3.01B11P219, and NBC series wireless controllers...