9936 matches found
CVE-2025-10044
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
MAL-2025-42964 Malicious code in @trp-beacon-ui-kit/style-tokens (npm)
The package @trp-beacon-ui-kit/style-tokens was found to contain malicious code...
MAL-2025-46160 Malicious code in subscription-test-semantic-ui-tailwindcss (npm)
The package subscription-test-semantic-ui-tailwindcss was found to contain malicious code...
Malicious code in element-ui-xenon-uranology-bunyan (npm)
The package element-ui-xenon-uranology-bunyan was found to contain malicious code...
Malicious code in markdown-perseus-betelgeuse-chakra-ui (npm)
The package markdown-perseus-betelgeuse-chakra-ui was found to contain malicious code...
Malicious code in algol-cross-env-biomimicry-semantic-ui (npm)
The package algol-cross-env-biomimicry-semantic-ui was found to contain malicious code...
CVE-2025-32320
A confused deputy vulnerability in the Android System UI allows for local escalation of privilege (EoP) . An attacker can exploit an obfuscated agent within the system's user interface to gain elevated privileges without requiring additional execution privileges or user interaction. This flaw may...
CVE-2025-32320
In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-21029
Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display...
PT-2025-36241
Name of the Vulnerable Software and Affected Versions: Android System UI affected versions not specified Description: A confused deputy condition exists in Android System UI that may allow applications to gain elevated privileges. This could lead to local escalation of privilege without requiring...
Google Android security vulnerabilities
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to an obfuscated agent in the system's user interface. An attacker can exploit the vulnerability to gain elevated privileges on the system...
CVE-2025-2694
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI...
CVE-2025-2694
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI...
CVE-2024-43184
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...
CVE-2024-43184
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...
CVE-2024-43184
IBM Jazz Foundation (part of IBM Engineering Lifecycle Management) is affected by CVE-2024-43184. Affected versions are 7.0.2 with iFix033, 7.0.3 with iFix012, and 7.1.0 with iFix002. The vulnerability is a cross-site scripting flaw that allows an unauthenticated attacker to embed arbitrary JavaS...
CVE-2024-43184 IBM Jazz Foundation cross-site scripting
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...
CVE-2024-43184 IBM Jazz Foundation cross-site scripting
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...
PT-2025-35944
Name of the Vulnerable Software and Affected Versions IBM Jazz Foundation versions 7.0.2 through 7.0.2 iFix033 IBM Jazz Foundation versions 7.0.3 through 7.0.3 iFix012 IBM Jazz Foundation versions 7.1.0 through 7.1.0 iFix002 Description The software is susceptible to cross-site scripting XSS. Thi...