5619 matches found
Apache Kyuubi 安全漏洞
Apache Kyuubi is a distributed SQL gateway from the Apache Foundation. Apache Kyuubi suffers from a directory traversal vulnerability that originates from a client-side bypass of server-side configuration, which can be exploited by an attacker to cause access to unauthorized local files...
CVE-2025-64119 Nuvation Energy BMS Client-side Authentication
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...
CVE-2025-64119
CVE-2025-64119 : A vulnerability in the Nuvation Battery Management System allows authentication bypass, affecting BMS versions up to 2.3.9. The entry is supported by other sources (Red Hat/EUVD) with the same description. The CVSSv4 metrics indicate critical impact (base score 9.3) across confid...
CVE-2025-62750 WordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through = 1.3.5...
ASLR-bypass-simulation
ASLR Bypass Simulator An interactive educational web applicat...
CVE-2025-66103
CVE-2025-66103 corresponds to a vulnerability in WPCal.io (as reported by Wordfence) affecting version up to 0.9.5.9, described as an Authenticated (Contributor+) Stored Cross-Site Scripting via the events_list_grouped shortcode and patched. The initial description also mentions a DOM-based XSS i...
[SECURITY] [DLA 4428-1] mediawiki security update
Debian LTS Advisory DLA-4428-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 30, 2025 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.35.13-1+deb11u6 CVE ID : CVE-2025-67475 CVE-2025-67478 CVE-2025-67479 CVE-2025-67480 CVE-2025-67481...
Exploit for Improper Certificate Validation in Apache Http_Server
Uefiscdi-Gov-Ro-Vulnerability- UNTESTED PAYLOADS, WAF-BYPASS,...
CVE-2025-14687
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...
PT-2025-135: Local File Read in mPDF
The vulnerability was identified in mPDF, version 2.8.5. The application performs improper validation of data received from the user, which allows an attacker to read files stored on the server. Vulnerability status: Confirmed during research Date of vulnerability discovery: 11.04.2025...
CVE-2025-14687
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...
CVE-2025-14687 Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...
CVE-2025-14687 Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...
EUVD-2025-205431
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...
CVE-2025-14687
CVE-2025-14687 affects IBM Db2 Intelligence Center versions 1.1.0–1.1.2. The vulnerability arises from client-side enforcement of server-side security mechanisms, allowing an authenticated user to perform unauthorized actions. Red Hat and CVE records corroborate the issue and reference the IBM ad...
CVE-2019-25235 Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages
Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system...
CVE-2019-25235 Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages
Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system...
CVE-2019-25235
The CVE-2019-25235 entry concerns Smartwares HOME easy 1.0.9, where an authentication bypass vulnerability allows unauthenticated attackers to access administrative web pages by disabling JavaScript. This enables navigation to multiple administrative endpoints and bypass of client-side validation...
CVE-2025-14823 Certificate Signing Extension Returns Encrypted Values
In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored a...