13120 matches found
CVE-2022-4503
Cross-site Scripting XSS - Generic in GitHub repository openemr/openemr prior to 7.0.0.2...
PT-2025-22740 · Unknown · Likecoin Web3Press
Name of the Vulnerable Software and Affected Versions: LikeCoin Web3Press versions n/a through 3.2.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in LikeCoin Web3Press...
CVE-2022-41941
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...
GHSA-C37V-3C8W-CRQ8 zot logs secrets
Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Details Container Image 15.04.2025: ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the abov...
CVE-2021-38419
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution...
CVE-2021-39270
In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur...
CVE-2025-48368 GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting XSS vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim'...
CVE-2025-46715 Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM)
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, ApiGetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to write t...
CVE-2020-5976
NVIDIA GeForce NOW, versions prior to 2.0.23 Windows, macOS and versions prior to 5.31 Android, Shield TV, contains a vulnerability in the application software where the network test component transmits sensitive information insecurely, which may lead to information disclosure...
CVE-2020-5515
Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection...
CVE-2020-0974
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932,...
CVE-2020-29612
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to execute arbitrary code with system privileges...
CVE-2025-0679 Exposure of Private Personal Information to an Unauthorized Actor in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured...
MAL-2025-4190 Malicious code in pragmatic-drag-and-drop (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-4182 Malicious code in hypernova-simple-example (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-4175 Malicious code in glovers-acquisition (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-4174 Malicious code in genesys-lib (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-4161 Malicious code in asdfghjklzxcvbnmmnbvcx (npm)
--- -= Per source details. Do not edit below this line.=-...