13213 matches found
Sensitive Information Disclosure
Jenkins Statistics Gatherer Plugin is vulnerable to Sensitive Information Disclosure. The vulnerability is due to storing the AWS Secret Key in plaintext in the global configuration file, allowing users with access to the Jenkins controller file system to read and misuse the credential...
Sensitive Information Disclosure
Jenkins Statistics Gatherer Plugin is vulnerable to Sensitive Information Disclosure. The vulnerability is due to failure to mask the AWS Secret Key in the global configuration UI, allowing attackers with configuration access to view and potentially capture the secret value...
CVE-2025-14572
A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation of the argument hidcontact results in memory corruption. Remote exploitation of the attack is possible. The exploit has been made public a...
WordPress Infility Global plugin <= 2.14.42 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin Infility Global versions = 2.14.42...
EUVD-2025-203000
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.23. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...
CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...
CVE-2025-12968
CVE-2025-12968 covers the Infility Global WordPress plugin. Wordfence details show an Authenticated (Subscriber+) Arbitrary File Upload vulnerability caused by: (1) upload_file MIME type validation, which can be spoofed, and (2) missing capability checks in import_data. Affected versions are up t...
CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...
CVE-2025-12968: Unrestricted Upload of File with Dangerous Type
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...
WordPress plugin Infility Global has a code vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...
UTT 512W Buffer Error Vulnerability
The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. The UTT Progress 512W suffers from a memory corruption vulnerability that originates...
OPAC-Global Access Control Compromise Data Compromise
The vulnerability of the automated library information system OPAC-Global is related to errors in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality of the protected information...
OPAC-Global Data Compromise
The vulnerability of the automated library information system OPAC-Global is related to inconsistencies in the responses to incoming queries. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality of the protected information...
Chain Reaction: Attack Campaign Activity in the Aftermath of React Server Components Vulnerability
Introduction and Vulnerability Overview Earlier this month, Imperva published an initial advisory outlining how our customers were protected against the newly disclosed React2Shell vulnerability impacting React Server Components RSC. That post focused on the essentials: a critical flaw arising fr...
EUVD-2020-30832
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global...
io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.0.1), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +9 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (2.3.0)
org.jenkins-ci.plugins:git-client MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25,...
com.testinium.jenkins:testinium (1.0), net.praqma:memory-map (>=2.2.0, <=2.2.1) +13 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.19.7)
org.jenkins-ci.plugins:git-client MAVEN version 1.19.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - com.testinium.jenkins:testinium 1.0 - net.praqma:memory-map =2.2.0, =2.4, =2.3, =2.0.5, =1.5...
CVE-2020-36900: Cross-Site Request Forgery (CSRF)
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global...
PT-2025-50521
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global...
