PT-2025-32472 · Unknown · Oitcode Samarium

Name of the Vulnerable Software and Affected Versions: oitcode samarium versions up to 0.9.6 Description: A critical vulnerability exists in oitcode samarium, allowing for unrestricted file uploads. The issue affects an unknown function within the /dashboard/product file of the Create Product Pag...

EMQX 代码问题漏洞

EMQX is an MQTT messaging server from EMQX Corporation. A code issue vulnerability exists in EMQX versions prior to 5.8.6 that stems from the Dashboard interface allowing the installation of arbitrary plugins, which could lead to a security risk...

CVE-2025-52136

EMQX before 5.8.6 may allow administrators to install arbitrary plugins via the Dashboard; this behavior is described as intended by the supplier. In 5.8.6 a defense‑in‑depth feature was added that controls plugin installation via the CLI command “emqx ctl plugins allow,” which determines a plugi...

CVE-2025-52136

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability for later Dashboard installation is set b...

Samarium 代码问题漏洞

Samarium is an open source business management system by oitcode individual developers. A code issue vulnerability exists in Samarium version 0.9.6 and earlier, which stems from an unrestricted upload in files/dashboard/product and could lead to a remote attack...

Linux Distros Unpatched Vulnerability : CVE-2016-4972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Murano before 1.0.3 liberty and 2.x before 2.0.1 mitaka, Murano-dashboard before 1.0.3 liberty and 2.x before 2.0.1 mitaka, and python-muranoclient...

CVE-2025-52136

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability for later Dashboard installation is set b...

PT-2025-32464 · Emqx · Emqx

Name of the Vulnerable Software and Affected Versions: EMQX versions prior to 5.8.6 Description: Administrators could install arbitrary novel plugins via the Dashboard web interface. The supplier considers this intended behavior; however, version 5.8.6 introduced a defense-in-depth feature...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: licenseclassifier, secrets-store-csi-driver-provider-gcp, aws-flb-kinesis, trillian, jaeger-operator, azure-workload-identity-webhook, cass-operator, pulumi-language-java, opa, fq, buildkitd, cert-manager-istio-csr, yam, kubernetes-replicator, aws-sigv4-proxy,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: licenseclassifier, secrets-store-csi-driver-provider-gcp, aws-flb-kinesis, trillian, jaeger-operator, azure-workload-identity-webhook, cass-operator, pulumi-language-java, opa, fq, buildkitd, cert-manager-istio-csr, yam, kubernetes-replicator, aws-sigv4-proxy,...

Malicious code in c-monitor-dashboard (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac5ace2c2268c16914bea284713d9bf69f2414d204cb79d4f32d8aa434b4eb The OpenSSF Package Analysis project identified 'c-monitor-dashboard'...

MAL-2025-6835 Malicious code in c-monitor-dashboard (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac5ace2c2268c16914bea284713d9bf69f2414d204cb79d4f32d8aa434b4eb The OpenSSF Package Analysis project identified 'c-monitor-dashboard'...

Security Bulletin: IBM Datapower Operations Dashboard could allow malicious or exploitable backend/content generators CVE-2023-38709

Summary Apache HTTP Server is used to deliver website content over the internet. Vulnerability Details CVEID:CVE-2023-38709 DESCRIPTION: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP...

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this vulnerabili...

Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login...

GHSA-4PCG-PJP5-3MC6 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and if victim is an admi...

GHSA-C5XF-RMV4-J85H Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the Conversation Messages Dashboard page. An attacker can execute arbitrary scripts in the context of a user's browser by...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Home Folder process on the Members Dashboard page. An attacker can execute arbitrary scripts in the context of another user's session by setting up a...

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this...