The vulnerability of the Dynamo Personalization Server component of the Oracle Commerce Platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Dynamo Personalization Server component of the Oracle Commerce Platform relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

ROS-20250430-11

The vulnerability in the PHP programming language interpreter is related to flaws in header processing of of HTTP requests. Exploitation of the vulnerability could allow an attacker acting remotely to send a hidden HTTP request HTTP Request Smuggling attack. A hidden HTTP request HTTP Request...

The vulnerability of the xdg-mail utility, a tool for opening email clients, stems from insufficient validation of data entered by users. This allows attackers to influence the integrity of the protected information.

The vulnerability of the xdg-mail tool for opening email clients is related to insufficient validation of the data entered by users. Exploiting this vulnerability allows a remote attacker to influence the integrity of the protected information...

OS Command Injection

tcg/voyager is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of input passed to a specific PHP Artisan command, allowing authenticated administrators to execute arbitrary OS commands in Laravel 8 or later...

PT-2025-16959

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Fortinet affected versions not specified Description A race condition exists in the Linux kernel within the accel/amdxdna component. When autosuspend is triggered, the rpm on flag is set to indicate...

CVE-2025-20236 Cisco Webex App Client-Side Remote Code Execution Vulnerability

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

CVE-2025-20236

Cisco Webex App is affected by a client-side vulnerability in the custom URL parser that could allow an unauthenticated attacker to convince a user to download arbitrary files, potentially executing commands with the user’s privileges. Root cause: insufficient input validation when processing mee...

CVE-2025-20236 Cisco Webex App Client-Side Remote Code Execution Vulnerability

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

Cisco Webex App Client-Side Remote Code Execution Vulnerability

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

PT-2025-16791

Name of the Vulnerable Software and Affected Versions Cisco Webex App versions 44.6 through 44.7 Cisco Webex App affected versions not specified Description A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download...

SQL Injection

com.vip.saturn, saturn-console is vulnerable to SQL injection. The vulnerability is due to SQL injection due to insufficient input validation in the /console/dashboard/executorCount?zkClusterKey component, allowing remote attackers to execute arbitrary code...

CVE-2024-47261

51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device...

Path Traversal

YesWiki is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation due to improper sanitization of the squelette parameter, allowing unauthorized file read access on the server...

The vulnerability of the tun.c component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the tun.c component in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the dma-mapping component in the Linux operating system allows a hacker to gain access to confidential data and also cause a service failure.

The vulnerability of the dma-mapping component in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to access confidential data and also cause service failures...

Server Side Request Forgery (SSRF)

Apache Kylin is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied input, allowing an attacker with admin access to make arbitrary internal requests via the /kylin/api/xxx/diag endpoint...

CVE-2024-47261

The CVE-2024-47261 entry describes a vulnerability in Axis OS devices where the VAPIX API endpoint uploadoverlayimage.cgi lacks sufficient input validation. This allows an attacker to upload files that can block access to create image overlays in the device’s web interface. Affected product scope...

PT-2025-07: Path Traversal in TCPDF

The vulnerability was identified in TCPDF, version 6.8.2. The application performs insufficient validation of user input data. Decoding user input allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequen...

CVE-2025-20120

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

Cisco TelePresence Management Suite XSS (cisco-sa-tms-xss-vuln-WbTcYwxG)

According to its self-reported version, Cisco TelePresence Management Suite is affected by a cross-site scripting vulnerability. - A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site...