274 matches found
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: aws-flb-cloudwatch-fips, amazon-ecs-agent-fips, etcd, pulumi-language-java, rabbitmq-messaging-topology-operator-fips, conftest-fips, rke2-runtime-fips, grafana-fips, commercial-chainloop-backend, kots, mattermost, azure-aad-pod-identity-mic, commercial-chainloop-cli...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: aws-flb-cloudwatch-fips, kyverno-policy-reporter-plugins-kyverno-fips, terraform-provider-time, amazon-ecs-agent-fips, grafana-pyroscope, etcd, consul-k8s-fips, k3d, oauth2-proxy-fips, pulumi-language-java, rabbitmq-messaging-topology-operator-fips,...
CVE-2026-28674
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...
CVE-2026-28674
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...
EUVD-2026-12702
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...
CVE-2026-28674
Product/Context: xiaoheiFS (self-hosted financial/operational system). Vulnerability: In versions ≤ 0.3.15, the AdminPaymentPluginUpload endpoint allows admins to upload any file to plugins/payment/ with only a hardcoded password (qweasd123456) and disregards file content. A background watcher (S...
CVE-2026-28674 xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...
GHSA-8FJ7-8H3W-XWFM vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-iam-fips, pulumi-language-java, crossplane-provider-aws-wafv2, crossplane-provider-aws-s3-fips, azure-service-operator-fips, caddy-fips, cloudbeat, crossplane-provider-aws-cloudformation-fips, rke2-runtime-fips,...
CVE-2026-27141 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-iam-fips, pulumi-language-java, crossplane-provider-aws-wafv2, crossplane-provider-aws-s3-fips, azure-service-operator-fips, caddy-fips, cloudbeat, crossplane-provider-aws-cloudformation-fips, rke2-runtime-fips,...
CVE-2020-37200
NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration key input that allows attackers to crash the application by supplying oversized input. Attackers can generate a 1000-character payload and paste it into the registration key field to trigger an application crash...
CVE-2020-36985
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...
CVE-2020-36985 IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...
CVE-2020-36985 IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...
CVE-2020-36985
IP Watcher 3.0.0.30 is affected by an unquoted service path vulnerability in its Windows service PACService.exe; the underlying issue is an unquoted binary path that allows local attackers to inject executables and run with elevated LocalSystem privileges at service startup. Documents confirm the...
EUVD-2020-30893
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...
PT-2026-5111
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...
CVE-2025-66156
Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through = 1.0.9...
CVE-2025-66156
Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through = 1.0.9...
CVE-2025-66156 WordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in merkulove Watcher for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through 1.0.9...
EUVD-2025-205986
Missing Authorization vulnerability in merkulove Watcher for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through 1.0.9...