1836 matches found
RosarioSIS 6.7.2 - Cross-Site Scripting
RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting XSS vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL. id: CVE-2020-15718 info: name:...
CVE-2026-17348
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...
EUVD-2026-51561
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...
CVE-2026-17348
In pgAdmin 4 SERVER mode, CVE-2026-17348 describes missing authentication enforcement on several routes (Constraints blueprint: nodes, proplist, and delete; preferences.get_all_cli; debugger.close; schema_diff.close). The lack of @pga_login_required allows an unauthenticated client to enumerate c...
CVE-2026-17348 pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...
PT-2026-66773
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga login required decorator; the application's before request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...
CVE-2026-57859
e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...
CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...
CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...
CVE-2026-57859
e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...
Oracle Linux 8 : firefox (ELSA-2026-47105)
The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-47105 advisory. 140.13.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.13.0 -...
firefox security update
140.13.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.13.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.13.0-1 - Update to 140.13.0 ESR...
CVE-2026-43672
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences...
CVE-2026-43672
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences...
EUVD-2026-49444
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences...
CVE-2026-43672
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences...
CVE-2026-43672
CVE-2026-43672 describes an authorization issue in macOS where improved state management fixes a vulnerability that could allow a malicious application to bypass Privacy preferences. The issue is resolved in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The connected sources co...
CVE-2026-66006
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
EUVD-2026-48612
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...