4937 matches found
elFinder <= 2.1.47 - Command Injection
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...
iTop Hub Connector - Information Disclosure
Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. id: CVE-2024-32870 info: name: iTop Hub...
CVE-2026-66452
CVE-2026-66452 affects the WordPress plugin “Legal Text Connector” by IT-Recht Kanzlei, versions
EUVD-2026-53885
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...
EUVD-2026-53703
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...
CVE-2026-70440
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-70440
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-70440
Vulnerability: Jenkins Qualys Container Scanning Connector Plugin, versions 1.8.0.5 and earlier, fails to escape user-controlled values in a JavaScript context, causing a stored XSS. Exploitation requires Item/Configure permission. As of the cited Jenkins advisory, there is no fix yet. Source: Je...
tomcat: Apache Tomcat: Error condition not handled when configuring CRLs
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...
tomcat: Apache Tomcat: Error condition not handled when configuring CRLs
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...
Atlassian Confluence Server - Path Traversal
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 the fixed version for 6.6.x, from version 6.7.0 before 6.12.3 the fixed version for 6.12.x, from version 6.13.0 before 6.13.3 the fixed version for 6.13.x, and from version 6.14.0 before 6.14.2 the fixed version for...
CVE-2026-16614 GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
Oracle Linux 8 : pki-deps:10.6 (ELSA-2026-43218)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-43218 advisory. - Resolves: CVE-2015-5262 - Resolves: CVE-2014-3577 - Resolves: rhbz1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in...
CVE-2026-11536
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...
CVE-2026-11536
CVE-2026-11536 affects IBM WebSphere Application Server versions including 8.5 and 9.0 (SOAP/JMX connector). Connected documents confirm an RCE vulnerability via the SOAP/JMX/HTTP interface with CWE-502 (Deserialization of Untrusted Data) and IBM CVSS data (up to 8.8 base score in some bulletins;...
CVE-2026-12947
CVE-2026-12947 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue involves storing potentially sensitive information in log files that could be read by a local user (CWE-532). IBM’s advisory lists the remediation via APAR IT49670, with fixes available...
WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.1 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by AeonRisk in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.1...
[SECURITY] Fedora 43 Update: nginx-mod-modsecurity-1.0.4-16.fc43
The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...
Important: Red Hat Security Advisory: mariadb-connector-c security update
An update for mariadb-connector-c is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...