14568 matches found
CVE-2019-11519
Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...
CVE-2019-11003
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature...
CVE-2019-11701
The default webcal: protocol handler will load a web site vulnerable to cross-site scripting XSS attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.. This...
CVE-2019-11004
In Materialize through 1.0.0, XSS is possible via the Toast feature...
CVE-2019-11222
gfbin128parse in utils/osdivers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafteddrmfile.xml file...
CVE-2019-20618
An issue was discovered on Samsung mobile devices with P9.0 software. The Pin Window feature allows unauthenticated unpinning of an app. The Samsung ID is SVE-2018-13765 March 2019...
CVE-2019-20087
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMFseekToSamples in GPMF-parse.c for the "matching tags" feature...
CVE-2019-20848
An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies...
CVE-2025-13781
GitLab EE was affected by a missing authorization check in GraphQL mutations that could let an authenticated user modify instance-wide AI feature provider settings. The issue impacted GitLab EE versions 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1. Remediation involved a patch r...
CVE-2025-13781 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...
CVE-2020-7483
VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an additional optional...
CVE-2020-23242
Cross Site Scripting XSS vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature...
CVE-2020-10116
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...
CVE-2020-10974
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3,...
CVE-2020-10570
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature...
CVE-2024-34582
Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi useridchange XSS within the Forgot Password feature...
CVE-2023-25488
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Duc Bui Quang WP Default Feature Image plugin = 1.0.1.1 versions...
CVE-2023-43649
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue...