5699 matches found
CVE-2025-24338
CVE-2025-24338 affects the web application of ctrlX OS, specifically the "Manages app data" functionality. A remote authenticated (low privilege) attacker can execute arbitrary client-side code in another user’s browser by sending multiple crafted HTTP requests. Evidence from multiple sources con...
PT-2025-18337 · Hcl · Domino Leap +1
Name of the Vulnerable Software and Affected Versions: HCL Domino Volt and Domino Leap affected versions not specified Description: The issue allows client-side script injection in the authoring environment and deployed applications. This can be achieved through multiple vectors in HCL Domino Vol...
HCL Leap 安全漏洞
HCL Leap is a low-code development platform from HCL India. HCL Leap has a security vulnerability that stems from an inadequate cleanup policy that could lead to client-side script injection...
PT-2025-18332 · Hcl · Hcl Domino Volt
Name of the Vulnerable Software and Affected Versions: HCL Domino Volt affected versions not specified Description: The issue is related to improper sanitization of SVG files, which allows client-side script injection in deployed applications. This can potentially lead to malicious script executi...
PT-2025-18258 · Ctrlx Os · Ctrlx Os
Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute arbitrar...
PT-2025-18336 · Hcl · Hcl Leap
Name of the Vulnerable Software and Affected Versions: HCL Leap affected versions not specified Description: The issue is related to an insufficient sanitization policy, which allows client-side script injection in the deployed application. This can be achieved through the HTML widget...
HCL Domino Volt和HCL Domino Leap 安全漏洞
HCL Domino Volt and HCL Domino Leap are both products of HCL India.HCL Domino Volt is a low-code application development solution based on the Domino platform.HCL Domino Leap is a cloud-based collaboration platform that modernizes traditional Domino applications. A security vulnerability exists i...
GHSA-2F8P-QQX2-GWR2 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Summary Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication This Proof of Concept has been performed using the followings: - YesWiki v4.5.3 doryphore-dev branch - Docker environnment docker/docker-compose.yml Vulnerable code The...
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Summary Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication This Proof of Concept has been performed using the followings: - YesWiki v4.5.3 doryphore-dev branch - Docker environnment docker/docker-compose.yml Vulnerable code The...
CVE-2025-46329
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...
CVE-2025-46329
The CVE-2025-46329 issue affects libsnowflakeclient (Snowflake Connector for C/C++). Versions 0.5.0 through before 2.2.0 log locally the client-side encryption master key of the target stage when the logging level is DEBUG during GET/PUT operations. This could expose sensitive information in loca...
CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...
CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...
Important: valkey
Issue Overview: Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not...
CVE-2022-44759
Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications...
CVE-2024-30114
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment...
CVE-2024-30147
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications...
CVE-2024-30113
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget...
WordPress plugin Xpro Elementor Addons - Pro 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...