CVE-2024-45426

Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access...

CVE-2025-22495

An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. Note -...

CVE-2025-25968

DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

PT-2025-9562

Name of the Vulnerable Software and Affected Versions ArcGIS Server affected versions not specified Description A SQL injection issue allows a remote authenticated user with elevated privileges to execute SQL injection, potentially modifying column properties. This has a high impact on integrity...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2024-56882

Sage DPW , an HR system from Sage UK, is vulnerable to Cross-Site Scripting (XSS) in versions prior to 2024_12_000 . The root cause is the unfiltered scripting of input fields, specifically Kurstitel and Kurzinfo . Low-privileged users with employee role privileges can permanently store malicious...

CVE-2024-56883

Sage DPW versions prior to 2024_12_001 are vulnerable to an Incorrect Access Control flaw. The software fails to consistently enforce role-based access controls on the server side, allowing low-privileged users with employee roles to create external courses for other employees. This is achieved b...

CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2024-45718

Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data...

CVE-2025-26375

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to create users with arbitrary privileges via crafted HTTP requests...

Intel System Security Report and System Resource Defense 竞争条件问题漏洞

Intel System Security Report and System Resources Defense is a security reporting and system resource defense firmware from Intel Corporation USA. Intel System Security Report and System Resource Defense suffers from a Competitive Condition Issue vulnerability that stems from the presence of a...

CVE-2024-45718

The CVE-2024-45718 vulnerability affects SolarWinds Kiwi Syslog Server NG (pre-1.3.1). Local, low-privilege access can reveal sensitive data stored in configuration files to non-privileged users. Impact is data exposure as described; exploitation details aren’t provided. Remediation: upgrade to v...

CVE-2024-45718 Sensitive data disclosure vulnerability

Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. A security vulnerability exists in Octopus Server that stems from the ability of a user with sufficient privileges to set a customized header in all server responses...

CVE-2022-25311

A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This coul...