106 matches found
CVE-2025-43018
CVE-2025-43018 affects HP LaserJet Pro printers and related HI-HP devices exposing information via the device’s local address book when queried by a non-authenticated user. The vulnerability is categorized as information disclosure with a CVSSv4 base score of 6.9 (NETWORK, LOW attack complexity, ...
HP LaserJet Pro 安全漏洞
HP LaserJet Pro is a line of laser printers and MFPs from Hewlett-Packard HP in the United States. A security vulnerability exists in the HP LaserJet Pro that stems from an information disclosure issue that could cause a non-authenticated user to query the device's local address book...
CVE-2022-27578
An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...
CVE-2021-44534
Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure...
CVE-2020-25191
Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboot the CompactRIO Driver versions prior to 20.5 remotely...
CVE-2025-4388
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...
GHSA-P2F8-VQ4R-GQG3 Liferay Portal Reflected XSS in marketplace-app-manager-web
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...
CVE-2025-4388
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...
CVE-2025-36625
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application...
CVE-2025-36625
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application...
CVE-2025-36625 Log Poisoning in Nessus
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application...
CVE-2025-36625
CVE-2025-36625 affects Tenable Nessus versions prior to 10.8.4. A non-authenticated attacker could alter Nessus logging entries by manipulating HTTP requests to the application. The issue is described across multiple sources as a log-poisoning vulnerability in Nessus’s logging mechanism triggered...
WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Multiple Location Google Map versions = 1.1...
CVE-2021-26087
An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a...
CVE-2025-23194 Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)
SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application...
CVE-2024-30619
Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=getcountmessage" AND "/main/inc/ajax/online.ajax.php?a=getusersonline."...
OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056
Integrates your Drupal website with the Oh Dear monitoring app. Cached data of monitoring results is accessible to non-logged in users when caching is enabled on the module. This vulnerability is mitigated by the fact that it only affects sites where caching is enabled for OhDear report healthche...
TYPO3 Information Disclosure in Install Tool
The Install Tool exposes the current TYPO3 version number to non-authenticated users...
