CVE-2022-21429

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications component: Billing Care. Supported versions that are affected are 12.0.0.4.0-12.0.0.6.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access v...

CVE-2022-41203

In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...

CVE-2020-26823

SAP Solution Manager JAVA stack, version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity and availability of the service...

CVE-2024-47590

An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser XXS or transmitted to...

CVE-2024-2221

qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the /collections/COLLECTION/snapshots/upload endpoint, specifically through the snapshot parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to...

ROS-20250130-02

Vulnerability of the nftverdictinit function in the net/netfilter/nftablesapi.c module of the operating system kernel Linux is related to the reuse of previously freed memory. Exploitation of the vulnerability could allow an attacker to affect the confidentiality, integrity, and availability of...

Advisory ROSA-SA-2025-2635

software: ncurses 6.2 WASP: ROSA-CHROME packageevrstring: ncurses-6.2 CVE-ID: CVE-2023-29491 BDU-ID: 2023-05772 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the ncurses terminal I/O control library is related to the ability to write beyond buffer boundaries in memory. Exploitation of the...

PT-2025-3980 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.110 Description: The issue is related to object corruption in the V8 engine of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page...

SAP NetWeaver AS ABAP Multiple Vulnerabilities

The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilies. - The ABAP Application Server of SAP NetWeaver as well as ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gai...

CVE-2025-24018 YesWiki Vulnerable to Authenticated Stored XSS

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the conten...

The software for creating automation projects of Schneider Electric’s Web Designer network modules BMXNOE0110H, BMENOC0311C, BMENOC0321C, and BMXNOR0200H is vulnerable due to incorrect restrictions on XML references to external objects. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the software used for creating automation projects in Schneider Electric’s Web Designer for network modules BMXNOE0110H, BMENOC0311C, BMENOC0321C, and BMXNOR0200H is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows ...

CVE-2025-0066

Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform Internet Communication Framework allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application...

CVE-2025-22141 WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity...

CVE-2025-22140

WeGIA (web manager for charitable institutions) has a SQL Injection in the endpoint /html/funcionario/dependente_listar_um.php, in the id_dependente parameter. The vulnerability allows arbitrary SQL execution with high impact to confidentiality, integrity, and availability. Affected versions are ...

PT-2025-49981

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description EDK2 contains a flaw in BIOS related to improper input validation. A local attacker may exploit this issue to alter control flow, potentially leading to arbitrary command execution. This could...

PT-2024-9919 · Gnu Grub +3 · Gnu Grub +3

Name of the Vulnerable Software and Affected Versions: GNU GRUB aka GRUB2 versions through 2.12 Description: The issue is a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. This can allow a remote attacker to impact the confidentiality, integrity, and...

The vulnerability of the “sta_log_htm” application programming interface in the microprogramming-based wireless access points of Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “staloghtm” application programming interface in the microprogramming-based wireless access points of Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO models exists due to the lack of measures taken to neutralize the special elements used in the operating syst...

CVE-2024-55877

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of XWiki.WikiMacroClass to any page. This compromises the confidentiality, integrity...

CVE-2024-55879

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. This compromises the confidentiality, integrity and...

CVE-2024-55879 XWiki allows RCE from script right in configurable sections

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. This compromises the confidentiality, integrity and...