CVE-2024-12019 Arbitrary File Read via Document API

The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to...

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature...

ZTE GoldenDB Unauthorized Access Vulnerability (CNVD-2025-10902)

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An unauthorized access vulnerability exists in ZTE GoldenDB, which stems...

Art Gallery Management System Cross-Site Scripting Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System version 1.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter search, which can be exploited by an...

IBM EntireX Information Disclosure Vulnerability (CNVD-2025-05562)

IBM EntireX is a versatile middleware solution from International Business Machines IBM designed to facilitate seamless integration between core enterprise applications and modern applications. An information disclosure vulnerability exists in IBM EntireX version 11.1 that originates from the...

CVE-2025-0900

PDF-XChange Editor is affected by CVE-2025-0900, a PDF file parsing out-of-bounds read information disclosure vulnerability. The flaw stems from inadequate validation of user-supplied data during PDF parsing, which can cause a read past the end of an allocated object. Exploitation requires user i...

CVE-2025-24998 Visual Studio Elevation of Privilege Vulnerability

...

SonicWall SonicOS SSLVPN Authentication Bypass

SonicWall SonicOS SSLVPN versions 7.1.1-7040 prior to 7.1.3-7015 and version 7.1.2-7019 are vulnerable to authentication bypass via a specially forged request that allows to hijack active SSL VPN sessions and gain unauthorized network access. No source data...

CVE-2024-12604

Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse. This issue affects Tap&Sign App: before V.1.025...

ROS-20250307-09

Vulnerability of raptorurinormalizepath in Raptor library is related to integer overflow when processing URIs in PDF files. Exploitation of the vulnerability allows an attacker to gain access to sensitive data...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05074)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05062)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05075)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

CVE-2024-58047

Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Linux Distros Unpatched Vulnerability : CVE-2023-25440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stored Cross Site Scripting XSS vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name...

CVE-2024-58047

Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-58046

Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Keysight Ixia Vision Product Family (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this these...

Linux Distros Unpatched Vulnerability : CVE-2017-10285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151,...

Linux Distros Unpatched Vulnerability : CVE-2014-3476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote...