Curl input validation vulnerability

The Curl version 7.20.0 to 8.22.0 contains a vulnerability related to input validation errors. This vulnerability arises when using the --remote-header-name -J option. If the intermediate 103 Early Hints response arrives before the final HTTP response, or if the ETag header is processed before...

TYPO3 FAL Protect authorization issue vulnerability

The TYPO3 FAL Protect version 1.7.1 up to 1.8.2 had an authorization issue vulnerability. This vulnerability stemmed from extensions not applying access protection to files stored in file storage that used non-default relative base paths. As a result, these files were directly provided by the web...

Advantech Adam-3600 path traversal vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a path traversal vulnerability. This vulnerability allows for attacks where path traversal is possible, potentially enabling authenticated attackers to access any file on the system...

Arizu Fast Tunnel permission permissions and access control issues

Arizu Fast Tunnel 1.0.0 version has a security vulnerability. This vulnerability stems from the improper handling of the pluginfile parameter in the ZipArchive::extractTo function within the Plugin Installer component. It may lead to unlimited file uploads...

Finsys Dockhand authorization issue vulnerability

Finsys Dockhand versions prior to 1.0.46 have an authorization vulnerability. This vulnerability arises because non-administrator users with the stacks:edit permission can use the /api/system/files/content path parameter to provide absolute paths for file reading, potentially leading to the...

Stormshield Network Security Authorization Issue Vulnerability

Stormshield Network Security versions 4.3.0 to 4.3.44, 4.8.0 to 4.8.19, 5.0.0 to 5.0.9, and 5.1.0 to 5.1.3 have an authorization issue vulnerability. This vulnerability arises from a failure in the dynamic data file signature check; there are logical errors in the signature verification routine,...

Apostrophe Technologies ApostropheCMS Resource Management Vulnerability

Apostrophe Technologies' ApostropheCMS has a resource management vulnerability. This vulnerability arises because authenticated importers can submit archived files whose number of decompressed bytes, number of entries, and size are not restricted before document type authorization. Failure in...

Oracle Autonomous Health Framework security vulnerabilities

A security vulnerability exists in Oracle Autonomous Health Framework versions 26.3 through 26.8. This vulnerability stems from issues within the Trace File Analyzer component and may allow low-privilege attackers to log in and execute infrastructure tasks. They could gain unauthorized access to...

Optimal IdM OptimalCloud: Input validation error vulnerability

The Optimal IdM OptimalCloud 5.0 version has a vulnerability related to input validation errors. This vulnerability stems from improper handling of the state parameter in the file/v5.0/social, which may lead to open redirection. Attackers can trigger this remotely...

DokuWiki.org DokuWiki deserialization injection vulnerability

DokuWiki.org: Versions prior to DokuWiki 2026-07-14c contained a deserialization injection vulnerability. This vulnerability stemmed from the use of Draft::getDraftText, which passed the content of the draft file to unserialize, without restricting the classes allowed. Authentication users with...

tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

DrayTek Vigor2960 path traversal vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a path traversal vulnerability. This vulnerability stems from incorrect handling of the setSWMProfile parameter in the function setSWMProfile located in the file/cgi-bin/mainfunction.cgi. This could lead to path traversal attacks, and attackers could...

Eosphoros DB-GPT Trust Management Vulnerabilities

eosphoros DB-GPT versions 0.8.2 and earlier have a trust management vulnerability. This vulnerability stems from hard-coded credentials in the default docker-compose.yml file. A static MYSQLROOTPASSWORD is set, and port 3306 is exposed on all interfaces. An attacker can authenticate as root@% and...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

Eclipse OpenJ9 input validation error vulnerability

Eclipse OpenJ9 versions 0.63 and earlier contain a security vulnerability. This vulnerability arises when the jdmpview tool or equivalent DTFJ code is used to open a specially crafted diagnostic dump package; it may then read any local file specified within the package and send its contents to an...

TYPO3 Fluid-Form: Encryption issue vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and before, as well as 5.0.10, have security vulnerabilities. These vulnerabilities stem from the use of a predictable token in the download link for uploading files via forms. Additionally, the filename in the request does not undergo anti-guessing...

Oracle Autonomous Health Framework security vulnerabilities

The Oracle Autonomous Health Framework versions 26.3 to 26.8 have security vulnerabilities. These vulnerabilities stem from issues with the Trace File Analyzer component. They could allow low-privilege attackers to log in to the infrastructure that runs Oracle Autonomous Health Framework and take...

Oracle Autonomous Health Framework security vulnerabilities

A security vulnerability exists in Oracle Autonomous Health Framework versions 26.3 through 26.8. This vulnerability stems from issues within the Trace File Analyzer component and may allow low-privilege attackers to log in, execute infrastructure tasks, and take control of Oracle Autonomous Heal...

Apostrophe Technologies ApostropheCMS Path Traversal Vulnerability

Apostrophe Technologies ApostropheCMS has a path traversal vulnerability. This vulnerability arises when the paths controlled by attackers reach the local backend, including segments of the parent directory. This allows for the escape of the configured upload directory, leading to path traversal...

Apple macOS numerical error vulnerability

Apple macOS versions prior to Golden Gate 27, Apple macOS Sequoia 15.8, and Apple macOS Tahoe 26.7 have security vulnerabilities. These vulnerabilities stem from integer underflow, which may lead to unexpected system termination when attackers control network file servers...