1720 matches found
HCL IEM Information Disclosure Vulnerability (CNVD-2025-20022)
HCL IEM is an intelligent event management platform from HCL India. HCL IEM suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
CVE-2025-43197
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data...
CVE-2025-43230
CVE-2025-43230 affects Apple platforms (iPadOS, iOS, macOS Sequoia, watchOS, visionOS, tvOS) with an issue that could allow an app to access user-sensitive data. The vulnerability is addressed by fixes in iPadOS 17.7.9, iPadOS 18.6, iOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, and visio...
CVE-2025-43252
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able to access sensitive user data when resolving symlinks...
CVE-2025-43246
This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access sensitive user data...
GHSA-W832-W3P8-CW29 z-push/z-push-dev SQL Injection Vulnerability
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...
CVE-2025-8264
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...
CVE-2025-8264
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...
CVE-2025-8264
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...
CVE-2025-8264
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...
CVE-2025-8264
CVE-2025-8264 affects z-push/z-push-dev prior to version 2.7.6 due to unparameterized queries in the IMAP backend, enabling SQL Injection via the username field in basic authentication. Impact stated as attacker could access and potentially modify or delete data in a linked third-party database. ...
CVE-2025-6495
CVE-2025-6495 affects the Bricks theme for WordPress (prior to 1.12.5; versions up to 1.12.4) with a blind SQL Injection via the p parameter caused by insufficient escaping and inadequate SQL query preparation. Exploitation is unauthenticated and can lead to leakage of sensitive data. Remediation...
CVE-2025-50184
DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...
CVE-2025-0249 HCL IEM is affected by an improper invalidation of access or JWT token vulnerability
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...
PT-2025-30437 · Autodesk · Autodesk Revit
Name of the Vulnerable Software and Affected Versions: Autodesk Revit affected versions not specified Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can trigger an Out-of-Bounds Read issue. A malicious actor could potentially leverage this issue to cause a crash,...
K000152658: Golang vulnerability CVE-2024-45341
Security Advisory Description A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make...
CVE-2025-4130 Hardcoded Credentials in PAVO Inc.'s PAVO Pay
Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025...
CVE-2025-41458 Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS
Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem...
CVE-2015-10133
The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the...