801 matches found
Esri ArcGIS Server cross-site scripting vulnerability
Esri ArcGIS Server is a web-oriented enterprise software platform available for providing geolocation services from Esri. A cross-site scripting vulnerability exists in Esri ArcGIS Server version 11.4 and earlier, which stems from a stored cross-site scripting issue that could lead to malicious...
Esri ArcGIS Server cross-site scripting vulnerability
Esri ArcGIS Server is a web-oriented enterprise software platform available for providing geolocation services from Esri. A cross-site scripting vulnerability exists in Esri ArcGIS Server version 11.4 and earlier, which stems from a stored cross-site scripting issue that could lead to malicious...
Orejime has executable code in HTML attributes
Impact On HTML elements handled by Orejime, one could run malicious code by embedding javascript: code within data attributes. When consenting to the related purpose, Orejime would turn data attributes into unprefixed ones i.e. data-href into href, thus executing the code. This shouldn't have any...
CVE-2025-59849
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal versions 10.1.0.0326 and lower may allow the execution of malicious code in web pages...
CVE-2025-55254
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal versions 10.1.0.0326 and lower may allow to execute malicious code in certain web pages...
CVE-2025-59849: Improper Restriction of Rendered UI Layers or Frames
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal versions 10.1.0.0326 and lower may allow the execution of malicious code in web pages...
CVE-2025-55254: URL Redirection to Untrusted Site
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal versions 10.1.0.0326 and lower may allow to execute malicious code in certain web pages...
HCL Launch and HCL DevOps Deploy security vulnerabilities
HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...
CVE-2025-36750 Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X
ShineLan-X contains a stored cross site scripting XSS vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code...
CVE-2025-36750
Summary: CVE-2025-36750 affects ShineLan-X (Growatt ShineLan-X) with a stored XSS in the Plant Name field. The vulnerability allows a malicious HTML payload to be stored and later displayed on the plant management page, potentially causing a legitimate user’s browser to execute arbitrary JavaScri...
Arbitrary File Upload
pytorch-lightning is vulnerable to Arbitrary File Upload. The vulnerability is due to improper validation of filenames in the /api/v1/uploadfile/ endpoint, which allows an attacker to overwrite arbitrary files and potentially execute malicious code...
CVE-2025-36748: Improper Neutralization of Input During Web Page Generation
ShineLan-X contains a stored cross site scripting XSS vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious...
CVE-2025-65829: Improper Control of Generation of Code
The ESP32 system on a chip SoC that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute on the device. The Secure Boot process forms a chain of trust by verifying all mutable software entities involved ...
Meatmeet Pro BBQ Thermometer has a security vulnerability
Meatmeet Pro BBQ Thermometer is an advanced smart thermometer from Meatmeet. A security vulnerability exists in Meatmeet Pro BBQ Thermometer version v1.0.34.4, which stems from the lack of Secure Boot functionality and could lead to malicious code execution...
CVE-2025-12507 Insecure service configuration – unquoted path
The service Bizerba Communication Server BCS has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed...
CVE-2025-12507 Insecure service configuration – unquoted path
The service Bizerba Communication Server BCS has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed...
Improper Input Validation
picklescan is vulnerable to Improper Input Validation. The vulnerability is due to inadequate validation in the scanning logic that fails to properly inspect pickle files with PyTorch-related extensions, which allows an attacker to bypass security checks and execute malicious code when the file i...
CVE-2025-34281: Improper Neutralization of Input During Web Page Generation
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...
