ROS-20250812-01

A vulnerability in the Guzzle HTTP client library of the PHP programming language interpreter is related to an incorrectly implemented security checks for standard elements. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information Vulnerability i...

PT-2025-32628 · WordPress · Uicore Elements

Name of the Vulnerable Software and Affected Versions: UiCore Elements – Free Elementor widgets and templates for WordPress versions up to and including 1.3.0 Description: The plugin is susceptible to arbitrary file reading via the prepare template function. This is due to a missing capability...

PT-2025-32741

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The software contains an issue with improper handling of additional special elements, potentially allowing an unauthorized attacker to perform spoofing over a network...

CVE-2025-6253: Missing Authorization

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the preparetemplate function due to a missing capability check and insufficient controls on the filename specified. This makes it...

WordPress UiCore Elements plugin <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read vulnerability

Missing Authorization to Unauthenticated Arbitrary File Read vulnerability discovered by mikemyers in WordPress Plugin UiCore Elements versions = 1.3.0...

40,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in UiCore Elements WordPress Plugin

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters!📢 🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per...

Linux Distros Unpatched Vulnerability : CVE-2024-27053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect...

Linux Distros Unpatched Vulnerability : CVE-2024-22362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a...

The vulnerability of the FortiMail email protection system and the FortiRecorder video surveillance device’s micro-programming software lies in the lack of measures to neutralize special elements, allowing intruders to execute arbitrary commands.

The vulnerability of the FortiMail email protection system and the FortiRecorder video surveillance device’s microprogramming software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

The vulnerability of the data collection and aggregation application from Cisco Spaces Connectors lies in the lack of measures taken to neutralize special elements used in operating system teams. This allows attackers to enhance their privileges and execute arbitrary code with root privileges.

The vulnerability of the data collection and aggregation application from Cisco Spaces Connector relates to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary...

The vulnerability of the UPDM_wstpCBCUpdStart() function of the Alpine iLX-507 audio system allows a hacker to execute arbitrary code in the context of the root user.

The vulnerability of the UPDMwstpCBCUpdStart function of the Alpine iLX-507 audio system exists due to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability can allow a hacker to execute arbitrary code under the root user’s context...

Linux Distros Unpatched Vulnerability : CVE-2018-5094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow vulnerability may occur in WebAssembly when shrinkElements is called followed by garbage collection on memory that is now uninitialized...

The vulnerability of the AI-based code editor Cursor lies in its lack of measures to neutralize special elements used in the operating system command. This allows a perpetrator to execute arbitrary code.

The vulnerability of the AI-based code editor Cursor relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the chrome.fileSystem interface in the Google Chrome browser allows a perpetrator to replace the user interface.

The vulnerability of the chrome.fileSystem interface in the Google Chrome browser is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability allows a remote attacker to replace the user’s interface...

Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write

...

The vulnerability of the DDSH CLI interface for Dell EMC Data Domain Operating Systems allows a perpetrator to execute arbitrary commands.

The vulnerability of the DDSH CLI interface for Dell EMC Data Domain Operating Systems is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to execute arbitrary commands...

Sensitive Information Disclosure

Opencast is vulnerable to Information Disclosure. The vulnerability is due to improper credential handling due to the system sending hashed global system account credentials to arbitrary URLs when fetching media package elements...

The vulnerability of the mcp-remote proxy server lies in its failure to eliminate special elements used in the operating system command, allowing attackers to execute arbitrary commands.

The vulnerability of the mcp-remote proxy server is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the GitK browser extension “gitk filename”, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the gitk browser extension exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

OESA-2025-1917 polkit security update

polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes. Security Fixes: A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggere...