CVE-2019-1388-Privilege-Escalation--2021-

CVE-2019-1388 Privilege Escalation CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7. CVE-2019-1388: Windows UAC Privilege Escalation Lab An educational cybersecurity lab and technical analysis documenting CVE-2019-1388 —a local...

Exploit for CVE-2026-112174

CVE-2026-112174 - Iperius Backup 8.8.3 Local Privilege Escalat...

CVE-2025-59847

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59847

HCL Domino Leap is vulnerable to Stored XSS via malicious application titles within the Manage page dialogs . This vulnerability allows an attacker to perform a session takeover of a user. The impact is categorized as Medium severity, requiring high privileges and user interaction. No specific ex...

CVE-2025-59848 HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59848

HCL Leap is vulnerable to Stored Cross-Site Scripting (XSS) caused by the improper neutralization of input during web page generation. Specifically, malicious application titles within the Manage page dialogs can be exploited. This vulnerability could allow an attacker to take over a user's sessi...

CVE-2025-59847: HCL Software HCL Domino Leap: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an…

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59848: HCL Software HCL Leap: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an…

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CLEANSTART-2024-YC15536 It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay

Security vulnerability affects the thunderbird package. It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay...

CLEANSTART-2024-IR65128 It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay

CVE-2023-5721 affects multiple packages. It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. See references for individual vulnerability details...

CVE-2026-63216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

CVE-2026-63216 Zammad: Stored XSS via unescaped option labels in the object attribute options context UI

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

CVE-2026-63216: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

Astra Linux – Vulnerability in Firefox and Thunderbird

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp being used to prevent input after the page loads. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

GHSA-WVRH-2F4M-924V ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

Summary ChatterBot's UbuntuCorpusTrainer.extract uses a predictable, home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern if not os.path.exists: os.makedirs followed by tar.extractallpath=self.datapath. A local attacker who pre-plants a symlink at the predictabl...

ClickFix Server Web-Based Social Engineering Delivery Browser Update Prompts

This Python program implements a web server that delivers browser-themed pages designed to instruct visitors to manually execute commands through operating system interfaces such as run dialogs or shell launchers...

Splunk Enterprise: Input Validation Error Vulnerability

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There is an input validation...

Google Android security vulnerabilities

Google Android is an open-source operating system based on Linux, developed by Google Inc. There are security vulnerabilities in Google Android. These vulnerabilities stem from the misleading or insufficient UI provided by the getCallingAppLabel function in CertInstaller.java, which may lead to t...

CVE-2026-8236

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. The...

CVE-2026-6826

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/fID with any file ID and receive a list of every page that references that file,...