CVE-2020-8482

Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data...

BIT-SUPERSET-2024-26016 Apache Superset: Improper authorization validation on dashboards and charts import

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...

CVE-2025-23058

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged read-only authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges...

CVE-2025-24480

CVE-2025-24480 affects Rockwell Automation FactoryTalk View (ME) prior to version 15.0. The root cause is lack of input sanitation leading to remote code execution by a high-privileged user. Public sources (NVD/NCSC/ICS advisories) confirm a remote code execution vulnerability with high impact on...

CVE-2025-23054 Authenticated Response Manipulation allows Unauthorized Actions in Management Interface

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files,...

PT-2025-1954 · WordPress · Social Share Buttons

Name of the Vulnerable Software and Affected Versions: Social Share Buttons for WordPress versions 2.7 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for exampl...

CVE-2024-55573

An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics...

CVE-2024-53923

CVE-2024-53923 – Centreon Web : Multiple sources (Red Hat, Snyk, CVE listings, PT Security, etc.) confirm a SQL injection in the media-upload form that can be triggered by a user with high privileges. Affected versions include Centreon Web 23.04.x (to 23.04.23), 23.10.x (to 23.10.18), 24.04.x (to...

Fortinet FortiClientWindows 安全漏洞

Fortinet FortiClientWindows is a Windows-based mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exis...

PT-2025-4795 · Hewlett Packard · Hpe Aruba Networking Fabric Composer

Name of the Vulnerable Software and Affected Versions: HPE Aruba Networking Fabric Composer affected versions not specified Description: A privilege escalation issue exists in the web-based management interface of HPE Aruba Networking Fabric Composer. This could allow an authenticated low-privile...

CVE-2025-21592

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface CLI of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system. Through the...

CVE-2025-21592

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface CLI of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system. Through the...

Juniper Networks Junos OS SRX 信息泄露漏洞

Juniper Networks Junos OS SRX is a Juniper Networks, Inc. network operating system designed for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. An information disclosure vulnerability exists in Juniper Networks Junos OS SRX, which...

PT-2025-1073

Name of the Vulnerable Software and Affected Versions Junos OS SRX Series versions prior to 21.4R3-S8 Junos OS SRX Series versions 22.2 through 22.2R3-S5 Junos OS SRX Series versions 22.3 through 22.3R3-S3 Junos OS SRX Series versions 22.4 through 22.4R3-S2 Junos OS SRX Series versions 23.2 throu...

Open Automation Software 安全漏洞

Open Automation Software OAS is an enterprise automation system from Open Automation Software, Inc. for visualizing, controlling, converting, and transferring data between virtually any industrial automation device or platform. A security vulnerability exists in versions prior to Open Automation...

postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

A flaw was found in PostgreSQL. This vulnerability allows a less-privileged application user to view or change unintended rows using SET ROLE, SET SESSION AUTHORIZATION, or equivalent features resulting in loss of confidentiality integrity and availability...

CVE-2024-45204

A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potential...

CVE-2024-9600

The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks...

CVE-2024-9600

CVE-2024-9600 affects the Ditty WordPress plugin (versions before 3.1.47). The issue is stored XSS caused by insufficient sanitisation/escaping of certain settings, allowing high-privilege users (e.g., authors) to execute script in the context of an admin. Public details from multiple sources (NV...

baltic-it TOPqw Webportal 安全漏洞

baltic-it TOPqw Webportal is a web application developed by a social service provider of the German company baltic-it. It can be used to publicly view information about various facilities. A security vulnerability exists in baltic-it TOPqw Webportal version v1.35.283.2, which stems from improper...