3417 matches found
CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...
CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...
CVE-2025-49586
XWiki is affected by CVE-2025-49586, a remote code execution (RCE) vulnerability in which any user with edit rights on at least one App Within Minutes application can obtain programming rights and execute code by editing the application. The flaw is fixed in XWiki releases 17.0.0, 16.4.7, and 16....
starcitizentools/citizen-skin allows stored XSS in user registration date message
Summary Various date messages returned by Language::userDate are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. Details The result of $this-lang-userDate $timestamp, $this-user returns unescaped values, but is inserted as raw HTML by...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from a user being able to gain programming privileges by editing the application, which could lead to remote code execution...
CVE-2025-42987
SAP Manage Processing Rules For Bank Statement allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application...
CVE-2025-42987 Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)
SAP Manage Processing Rules For Bank Statement allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application...
Do Concept Replacement Techniques Really Erase Unacceptable Concepts?
Generative models, particularly diffusion-based text-to-image T2I models, have demonstrated astounding success. However, aligning them to avoid generating content with unacceptable concepts e.g., offensive or copyrighted content, or celebrity likenesses remains a significant challenge. Concept...
SAP Manage Processing Rules 安全漏洞
SAP is enterprise applications, enterprise resource management applications, supply chain management applications, procurement applications, travel and expense management software. An authorization issue vulnerability exists in SAP Manage Processing Rules, which stems from insufficient...
Private Memorization Editing: Turning Memorization into a Defense to Strengthen Data Privacy in Large Language Models
Large Language Models LLMs memorize, and thus, among huge amounts of uncontrolled data, may memorize Personally Identifiable Information PII, which should not be stored and, consequently, not leaked. In this paper, we introduce Private Memorization Editing PME, an approach for preventing private...
Photoshop for Beginners – Overview of Top Skills and How to Hone Them
What comes to your mind when you think of Photoshop? A tool for editing and retouching photos -…...
[SECURITY] Fedora 42 Update: nextcloud-31.0.5-1.fc42
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
CVE-2025-48475
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the...
CVE-2025-48476 FreeScout Has Business Logic Errors
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result...
CVE-2025-45343
An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmodules route...
📄 Unifiedtransform 2.x Course Editor Missing Authorization
Unifiedtransform version 2.x allows any user to access and modify course records via the /course/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints...
CVE-2025-48475 FreeScout Vulnerable to Insufficient Authorization
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the...
CVE-2025-45343
An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmodules route...
PT-2025-23091
Name of the Vulnerable Software and Affected Versions Tenda W18E version 2.0 v.16.01.0.11 Description An issue in Tenda W18E allows an attacker to execute arbitrary code via the editing functionality of the account module in the "goform/setmodules" route. Recommendations For Tenda W18E version 2....