30920 matches found
Dolibarr Unauthenticated Contacts Database Theft
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...
Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting
Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...
Ghost CMS - User Enumeration
Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...
SonicWall GMS and Analytics Web Services - Shell Injection
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions id: CVE-2023-34124 info: name: SonicWall GMS and Analytics Web...
Roxy Fileman 1.4.5 - Unrestricted File Upload
Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. id: CVE-2018-20526 info: name: Roxy Fileman 1.4.5 -...
Pega Infinity - Authentication Bypass
Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. id: CVE-2021-27651 info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainf...
Codoforum 5.1 - Arbitrary File Upload
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain...
MetInfo 7.0.0 beta - SQL Injection
MetInfo 7.0.0 beta is susceptible to SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter a different issue than CVE-2019-16997. id: CVE-2019-17418 info: name: MetInfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description: | MetInfo...
Jira - Incorrect Authorization
Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...
SUSE CVE-2026-48794
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific edge cases, an access control rule may b...
SUSE CVE-2026-49821
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...
ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root
Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-44185 CVE-2026-44185 in rootio-apache2 - Patched by Root
Root has patched CVE-2026-44185 in the rootio-apache2 package for Root:Debian:13. Multiple fixed versions available...
CLEANSTART-2026-AR53211 Security fixes in kubernetes-dns-node-cache 1.24.1-r0
Package kubernetes-dns-node-cache version 1.24.1-r0 fixes 2 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf...
GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text
Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...
ROOT-APP-NPM-CVE-2026-44495 CVE-2026-44495 in @rootio/axios - Patched by Root
Root has patched CVE-2026-44495 in the @rootio/axios package for Root:npm. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-48959 CVE-2026-48959 in rootio-perl - Patched by Root
Root has patched CVE-2026-48959 in the rootio-perl package for Root:Debian:13. Multiple fixed versions available...