8280 matches found
HCL Digital Experience 安全漏洞
HCL Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL India. A security vulnerability exists in HCL Digital Experience that stems from the restricted access administrative interface being susceptible to cross-site scripting attacks...
PT-2025-33823 · Hcl · Hcl Digital Experience
Name of the Vulnerable Software and Affected Versions: HCL Digital Experience affected versions not specified Description: HCL Digital Experience is susceptible to cross-site scripting XSS within an administrative user interface that has restricted access. Recommendations: At the moment, there is...
ROS-20250819-06
Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...
UBUNTU-CVE-2025-53192
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue, the OGNL engine parses and evaluates the provided expression with powerful capabilities...
CVE-2025-53192
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue, the OGNL engine parses and evaluates the provided expression with powerful capabilities...
BIT-GITLAB-2025-2498 Insufficient Granularity of Access Control in GitLab
An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...
The vulnerability of Fortinet’s software products arises from incorrect restrictions on path names in restricted access catalogs, allowing attackers to overwrite arbitrary files.
The vulnerability of Fortinet’s software products is related to incorrect restrictions on path names in the restricted access catalog. Exploiting this vulnerability allows a malicious actor to overwrite arbitrary files remotely...
The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain unauthorized access to protected information.
The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to gain...
The vulnerability of the CPython interpreter, related to incorrect restrictions on path names to restricted directories, allows attackers to compromise the integrity of protected information.
The vulnerability of the CPython interpreter is related to incorrect restrictions on path names to restricted directories. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...
The vulnerability of the tarfile module in the CPython interpreter allows a attacker to compromise the integrity of the protected information.
The vulnerability of the tarfile module in the CPython interpreter is related to incorrect restrictions on the path name for directories with restricted access. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
CVE-2025-2498
An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...
WordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Bao BlueRock in WordPress Plugin WP Discord Post Plus Supports Unlimited Channels versions = 1.0.2...
SUSE CVE-2025-8713
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
CVE-2025-48807
Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally...
AZL-66321 CVE-2025-8713 affecting package postgresql for versions less than 14.19-1
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
CVE-2025-8713
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
CVE-2025-4390
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validaterestrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted...
CVE-2025-42936
The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impac...
D-Link DIR-818L 注入漏洞
The D-Link DIR-818L is a WiFi router from the Chinese company AUO D-Link. The D-Link DIR-818L suffers from an injection vulnerability that originates from a misbehavior in the file /htdocs/cgibin, which can be exploited by an attacker to bypass authentication and access restricted data by injecti...
The vulnerability of the fileupload-cgi CGI script of the Zyxel networking devices allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the fileupload-cgi CGI script of the Zyxel networking device lies in an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...