WordPress UiChemy cross-site scripting vulnerability

WordPress UiChemy versions 5.3.0 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping for the parameters actionssavebuilderdataelements...settingsslotNlinkurl. It may lead to stored cross-site scripting, allowing...

Decoding the Legalese: A Scalable and Quantitative Framework for Analyzing Corporate Privacy Policies

Even though privacy policies are the primary mechanism organizations use to disclose how they collect, process, and share personal data, they are difficult for average users to interpret, perhaps by design, due to their verbosity and dense legal language. Importantly, there is a lack of...

Large Scale VPN PAN-OS Disclosure

The vulnerability of the Large Scale VPN LSVPN module of the PAN-OS operating system is related to the incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms remotely...

Zabbix Privilege Escalation

The vulnerability of the Zabbix universal monitoring system lies in the provision of data elements for erroneous sessions. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

[SECURITY] Fedora 42 Update: python-pydicom-3.0.2-1.fc42

pydicom is a pure python package for working with DICOM files. It was made for inspecting and modifying DICOM data in an easy "pythonic" way. The modifications can be written again to a new file. pydicom is not a DICOM server, and is not primarily about viewing images. It is designed to let you...

PowerDNS Recursor Output Validation

The vulnerability of the PowerDNS Recursor DNS server relates to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of the protected information...

EUVD-2025-4687

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-38478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - kernel: comedi: Fix initialization of data for instructions that write to subdevice Ubuntu Linux - comedi: Fix initialization of data...

IBM DB2 DoS

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to the improper elimination of special elements in data queries. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending...

CVE-2025-38478

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn-n elements in some cases. The doinsnioctl...

Atlassian Bamboo Local File Access Execution

The vulnerability of the Atlassian Bamboo continuous integration system is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to gain access to local server files and execute them...

DCH-compatible Thunderbolt Driver Privilege Escalation

The vulnerability of the DCH-compatible Thunderbolt driver is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow an attacker to increase their privileges...

DCH-compatible Thunderbolt Driver Unauthorized Access

The vulnerability of the DCH-compatible Thunderbolt driver is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2023-6519

Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7...

CVE-2023-31275

An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability...

WPS Office ET Data use of uninitialized pointer vulnerability

Talos Vulnerability Report TALOS-2023-1748 WPS Office ET Data use of uninitialized pointer vulnerability November 27, 2023 CVE Number CVE-2023-31275 SUMMARY An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel fil...

Pentaho Business Analytics Server Arbitrary Command Execution

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the incorrect elimination of certain elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by injecting specially crafted Spring templates...

Websoft HCM Automation Software XQuery Logic Alteration

The vulnerability of Websoft HCM’s automation software for HR processes is related to deficiencies in the process of eliminating special elements from output data. Exploiting this vulnerability allows a malicious actor to remotely carry out an attack aimed at altering the query logic in the XQuer...

SAP Business One Code Execution

The vulnerability of the SAP Business One resource management system is related to insufficient cleaning of special elements in the output data used by the incoming component. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-6R5V-HP32-FJQW Improper Access Control in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."...