CVE-2022-39351

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

DoS (Denial of Service) Third-Party Dependency in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in version 7.19 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

CVE-2021-39221

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...

CVE-2021-32748

Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI "Web Application Open Platform Interface" protocol to communicate with the Collabora Editor, the communication between these two services was not protected by a credentials or IP check. Whilst this does n...

CVE-2020-9353

An issue was discovered in SmartClient 12.0. The Remote Procedure Call RPC loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML...

CVE-2019-3422

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remo...

CVE-2019-9682

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker c...

CVE-2019-13554

GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credentials. GE recommends that users disable the Telnet service...

CVE-2014-125001

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...

PT-2025-22475 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue has been found in the DEBUG Command Handler component, which can be exploited remotely. The manipulation of this component leads to a buffer overflow. Recommendations: For FreeFlo...

PT-2025-22452 · WordPress · Hot Random Image

Name of the Vulnerable Software and Affected Versions: Hot Random Image plugin for WordPress versions up to, and including, 1.9.2 Description: The issue allows authenticated attackers with Contributor-level access and above to access arbitrary images with allowed extensions outside of the...

PT-2025-22461 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical vulnerability was found in the PROMPT Command Handler component of FreeFloat FTP Server, leading to a buffer overflow. This issue can be exploited remotely. The vulnerability is...

PT-2025-22557 · Ocuco Innovation · Invclient.Exe

Name of the Vulnerable Software and Affected Versions: Ocuco Innovation - INVCLIENT.EXE version 2.10.24.5 Description: The issue allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Recommendations: For Ocuco Innovation - INVCLIENT.EXE versi...

PT-2025-22512 · Sandboxie · Sandboxie

Name of the Vulnerable Software and Affected Versions: Sandboxie versions 1.3.0 through 1.15.12 Description: The issue arises from the failure of Api SetSecureParam to sanitize incoming pointers, implicitly trusting the pointer passed by the user as safe to read from. This allows SetRegValue to...

PT-2025-22558 · Ocuco Innovation · Reports.Exe

Name of the Vulnerable Software and Affected Versions: Ocuco Innovation - REPORTS.EXE version 2.10.24.13 Description: The issue allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Recommendations: For Ocuco Innovation - REPORTS.EXE version...

PT-2025-22556 · Ocuco Innovation · Reportserver.Exe

Name of the Vulnerable Software and Affected Versions: Ocuco Innovation - REPORTSERVER.EXE version 2.10.24.13 Description: An issue in the REPORTSERVER.EXE allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Recommendations: For Ocuco...

PT-2025-22451 · WordPress · Hot Random Image

Name of the Vulnerable Software and Affected Versions: Hot Random Image plugin for WordPress versions up to, and including, 1.9.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-22375

Name of the Vulnerable Software and Affected Versions TYPO3 ns backup extension versions prior to 13.0.1 Description The issue allows for XSS. Recommendations For versions prior to 13.0.1, update to version 13.0.1 or later to resolve the issue...

PT-2025-22322 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms versions up to 2.3.2.240702 Description: A problematic issue was found in HkCms, affecting an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the keyword argument leads to cross-site...

PT-2025-22394 · Cisco · Cisco Webex

Name of the Vulnerable Software and Affected Versions: Cisco Webex affected versions not specified Description: A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The issue is due to improper filtering of user-supplied inpu...