13458 matches found
WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Prissy in WordPress Plugin Thim Elementor Kit versions = 1.2.8...
WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k in WordPress Plugin PageLayer versions = 1.9.4...
WordPress MachForm Shortcode plugin <= 1.4.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin MachForm Shortcode versions = 1.4.1...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in rexml-3.3.6.gem
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of rexml-3.3.6.gem . Vulnerability Details CVEID:CVE-2024-49761 DESCRIPTION: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Ansible
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ansible Vulnerability Details CVEID:CVE-2023-5764 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary code on the system, caused by a template injection flaw. By sending a...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of http-proxy-middleware Vulnerability Details CVEID:CVE-2024-21536 DESCRIPTION: http-proxy-middleware is vulnerable to a denial of service, caused by an UnhandledPromiseRejection error thrown by micromatch. By...
CVE-2025-23227
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
CVE-2025-23227
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
CVE-2025-23227
CVE-2025-23227 affects IBM Tivoli Application Dependency Discovery Manager (TADDM) versions 7.3.0.0 through 7.3.0.11. The issue is a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially leading to credential disclosu...
CVE-2025-23227 IBM Tivoli Application Dependency Discovery Manager cross-site scripting
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
PT-2025-4861 · Ibm · Ibm Tivoli Application Dependency Discovery Manager
Name of the Vulnerable Software and Affected Versions: IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.0 through 7.3.0.11 Description: This issue allows authenticated users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and...
Amazon AWS Identity and Access Management 安全漏洞
Amazon AWS Identity and Access Management Amazon AWS IAM is a web service from Amazon.com, Inc. that is used to securely control access to AWS services. A security vulnerability exists in Amazon AWS Identity and Access Management, which stems from variable response times in the user login process...
CVE-2024-49734
In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to side channel information disclosure. This could lead to remote information disclosure with no additional execution privileges needed. Use...
WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery vulnerability
Authenticated Subscriber+ Server-Side Request Forgery vulnerability discovered by shaman0x01 in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure which allows an attacker to determine the existence of user accounts by analyzing the response times and codes. Remediation Upgrade Umbraco.Cms.Api.Management to version 14.3.2, 15.1.2 or higher. References - GitHub...
WordPress WPBot Pro Wordpress Chatbot plugin <= 13.5.4 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.5.4...
Scaling Dynamic Application Security Testing (DAST)
Introduction Microsoft engineering teams use the Security Development Lifecycle to ensure our products are built in alignment with Microsoft’s Secure Future Initiative security principles: Secure by Design, Secure by Default, and Secure Operations. A key component of the Security Development...
Insecure default config access in WriteFreely
WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini...
