CLSA-2025-1740740956 flatpak: Fix of CVE-2023-28101

CVE-2023-28101: fix issue of hiding elevated permissions by setting crafted values containing non-printable control characters...

Cross-Site Request Forgery (CSRF)

leantime/leantime is vulnerable to cross-site request forgery CSRF. The vulnerability is due to CSRF allowing a remote attacker to create an account with elevated privileges by tricking an Owner or Administrator into clicking a malicious link...

WordPress plugin Directorist: An AI-powered business directory plugin with classified ads listings – License-related vulnerabilities

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Directorist: AI-Powere...

PT-2025-11530 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a low-privileged...

CVE-2025-25476

A stored cross-site scripting XSS vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component...

CVE-2025-25476

A stored cross-site scripting XSS vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component...

CVE-2025-25476: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component...

CVE-2025-1755

MongoDB Compass (Windows) is affected by CVE-2025-1755: a local privilege escalation vulnerability when a crafted file is stored in C:\node_modules, affecting versions prior to 1.42.1. The condition described enables elevated-privilege actions on the user’s system. Several connected sources (incl...

PT-2025-9033 · Infoblox · Infoblox Nios

Name of the Vulnerable Software and Affected Versions: Infoblox NIOS versions prior to 8.6.5 Description: The issue allows Infoblox NIOS to execute with more privileges than required. Recommendations: For versions prior to 8.6.5, update to version 8.6.5 or later to resolve the issue...

WordPress plugin NextGEN Gallery has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-55898

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2024-55898

CVE-2024-55898 – IBM i privilege escalation . Affected product: IBM i versions 7.2, 7.3, 7.4, and 7.5. The issue arises from an unqualified library call (CWE-427) that could allow a user with the capability to compile or restore a program to execute user-controlled code with administrator privile...

CVE-2024-55898 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege...

Security Bulletin: IBM i is vulnerable to a user gaining elevated privileges due to an unqualified library call [CVE-2024-55898].

Summary IBM i is vulnerable to a user with the capability to compile or restore a program to gain elevated priviliges due to an unqualified library call as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the account creation process. An attacker can manipulate the session of a logged-in administrator to create a new account with elevated privileges by tricking the administrator into interacting with a...

PT-2025-7322

Name of the Vulnerable Software and Affected Versions Carrier - Block Load versions 4.00 through 4.16 Description An uncontrolled search path element issue exists, potentially allowing an attacker to perform DLL hijacking and execute arbitrary code with elevated privileges. This issue is reported...

WordPress plugin CarSpot has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin GetBookingsWP has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

SUSE CVE-2023-20900

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a...

CVE-2024-30165

Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164...