CVE-2025-9658

CVE-2025-9658 affects O2OA up to version 10.0-410, specifically the Personal Profile Page component where an unknown function in the file path /x_portal_assemble_designer/jaxrs/dict/ allows manipulating the parameter name/alias/description. This leads to cross-site scripting, with remote exploita...

CVE-2025-9657 O2OA Personal Profile script cross site scripting

A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /xprogramcenter/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched...

CVE-2025-9657 O2OA Personal Profile script cross site scripting

A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /xprogramcenter/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched...

CVE-2025-9655

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...

CVE-2025-9655

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...

CVE-2025-9655 O2OA Personal Profile person cross site scripting

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...

CVE-2025-9655 O2OA Personal Profile person cross site scripting

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...

CVE-2025-9655

CVE-2025-9655 affects O2OA up to version 10.0-410, specifically the Personal Profile Page component. The issue arises from manipulating the Description argument in the /x_organization_assemble_control/jaxrs/person/ file, enabling cross-site scripting. Exploitation can be performed remotely. Vendo...

PT-2025-35231

Name of the Vulnerable Software and Affected Versions: O2OA versions up to 10.0-410 Description: A cross site scripting issue exists due to the manipulation of the name, alias, or description argument in the processing of the /x program center/jaxrs/script file within the Personal Profile Page...

PT-2025-35247

Name of the Vulnerable Software and Affected Versions: O2OA versions prior to 10.0-410 Description: A cross-site scripting issue exists in O2OA’s Personal Profile Page component. The issue is related to an unknown function within the /x portal assemble designer/jaxrs/widget file. Successful...

PT-2025-35246

Name of the Vulnerable Software and Affected Versions: O2OA versions prior to 10.0-410 Description: A flaw has been found in O2OA that allows for cross site scripting. The issue is related to the manipulation of the argument name/alias/description within an unknown function of the file /x portal...

Linux Distros Unpatched Vulnerability : CVE-2021-21435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Article Bcc fields and agent personal information are shown when customer prints the ticket PDF via external interface. This issue affects: OTRS AG OTRS 7.0.x...

Linux Distros Unpatched Vulnerability : CVE-2020-12275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API. CVE-2020-12275 Note...

Linux Distros Unpatched Vulnerability : CVE-2019-12497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through...

Blog 安全漏洞

Blog is a personal blogging system by Xuzijia Individual Developers in China. A security vulnerability exists in Blog version 3.0.1-SNAPSHOT, which stems from an authentication bypass that could lead to unauthorized access to the API...

CVE-2025-53795

Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-53795 Microsoft PC Manager Elevation of Privilege Vulnerability

...

Nearly 1M SSNs and Health Records Exposed in Marijuana Patient Database

Ohio Medical Alliance exposed a medical marijuana patient database containing 957,000 records, including SSNs, IDs, health files, and…...

PandoraNext-TokensTool 安全漏洞

PandoraNext-TokensTool is a management software for PandoraNext by Clivia Personal Developer! A security vulnerability exists in PandoraNext-TokensTool version 0.6.8 and earlier, which stems from the ability to bypass authentication to access the API...

my-site 安全漏洞

my-site is WinterChenS individual developer's personal website based on springboot 2.0 development, integrated with: personal home page, personal blog, personal works. A security vulnerability exists in my-site version 6c79286, which stems from an authentication bypass that could lead to...