16955 matches found
CVE-2024-54248
Cross-Site Request Forgery CSRF vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through = 1.8.2.4...
CVE-2024-6633
The default credentials for the setup HSQL database HSQLDB for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The HSQLDB is only included to facilitate...
CVE-2024-2637
An Uncontrolled Search Path Element vulnerability in B Industrial Automation Scene Viewer, B Industrial Automation Automation Runtime, B Industrial Automation mapp Vision, B Industrial Automation mapp View, B Industrial Automation mapp Cockpit, B Industrial Automation mapp Safety, B Industrial...
CVE-2024-11422
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...
CVE-2024-28028
Improper input validation in some IntelR Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...
CVE-2024-31260
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2...
CVE-2024-22287
Cross-Site Request Forgery CSRF vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting XSS.This issue affects Better Anchor Links: from n/a through 1.7.5...
CVE-2024-48878
Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report...
CVE-2024-0359
A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely...
CVE-2024-53804
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through = 1.8.16.0...
CVE-2025-23015 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on...
BIT-MLFLOW-2024-3573 Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow
mlflow/mlflow is vulnerable to Local File Inclusion LFI due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'islocaluri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the...
Cross Site Scripting (XSS)
DevDojo Voyager is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input sanitization in the /admin/compass endpoint, which allows user-supplied input to be reflected in the response without proper encoding or filtering...
Jenkins Zoom Plugin is Missing Password Field Masking
Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...
Sparkle Signing Checks Bypass
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s EdDSA signing checks...
ALSA-2025:0923 Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...
CVE-2025-24962 Command Injection in reNgine
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmapcmd parameters. This issue has been addressed in commit c28e5c8d and is expected in the next versioned release. Users are advised to filter user input and monitor the...
MAL-2025-889 Malicious code in x509-escaping (npm)
--- -= Per source details. Do not edit below this line.=-...