15764 matches found
CVE-2025-40915 Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand function...
Esri Portal For ArcGis Cross-Site Request Forgery Vulnerability
Esri Portal For ArcGis is a core component of ArcGIS Enterprise that is used to share maps, scenes, applications, and geographic information within an organization, enabling centralized management of and access to the content through a web site. A cross-site request forgery vulnerability exists i...
MetaCPAN Perl Mojolicious::Plugin::CSRF 安全特征问题漏洞
MetaCPAN Perl Mojolicious::Plugin::CSRF is a CSRF defense plugin from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN Perl Mojolicious::Plugin::CSRF version 1.03 that stems from the use of a weak random number source to generate CSRF tokens...
PT-2025-25230 · Unknown · Mojolicious::Plugin::Csrf
Name of the Vulnerable Software and Affected Versions: Mojolicious::Plugin::CSRF version 1.03 Description: The issue concerns a weak random number source used for generating CSRF tokens. Specifically, the tokens are generated as an MD5 of the process id, the current time, and a single call to the...
Information Exposure
Overview nautobot is a Source of truth and network automation platform. Affected versions of this package are vulnerable to Information Exposure due to the improper enforcement of authentication mechanisms on the MEDIAROOT directory. An attacker can retrieve files by guessing or knowing the corre...
Traffic Offense Reporting System Cross-Site Request Forgery Vulnerability
Traffic Offense Reporting System is a traffic violation reporting system. The Traffic Offense Reporting System suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker cou...
CVE-2025-46612
The CVE-2025-46612 issue affects Airleader Master and Airleader Easy before version 6.36. The Panel Designer dashboard permits unrestricted file uploads via wizard/workspace.jsp, enabling remote command execution when an attacker logs into the administrator console (default credentials are weak) ...
Apache CloudStack 信息泄露漏洞
Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from an information disclosure vulnerabilit...
CVE-2025-45055
Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...
The vulnerability of the handle_request function in the ASUS GT-AC2900 router allows a hacker to gain unauthorized access to the administrator interface.
The vulnerability of the handlerequest function in ASUS GT-AC2900 routers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the administrator interface...
CVE-2025-45055
Silverpeas 6.4.2 is affected in the Event Management module by a stored XSS flaw: an authenticated user can upload a malicious SVG as an event attachment, and when an administrator views it, embedded JavaScript can run in the admin session. This stems from insufficient sanitization of SVG files a...
CVE-2025-45055
Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...
The vulnerability of the software-based TLS protocol implementation of Acronis Cyber Protect 16 allows attackers to compromise the confidentiality and integrity of the protected information.
The vulnerability of the software-based TLS protection implementation in Acronis Cyber Protect 16 lies in the insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...
The vulnerability of the Apache Superset data visualization software lies in the lack of measures taken to protect the SQL query structure, allowing attackers to gain unauthorized access to the protected information.
The vulnerability of the Apache Superset data visualization software relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected information...
CVE-2024-22330
IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...
CVE-2024-22330 IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...
CVE-2024-22330
CVE-2024-22330 affects IBM Security Verify Governance ISVG 10.0.2 where default password policy does not require strong passwords, exposing accounts to compromise. Public metrics indicate a high-impact CVSS 3.1 base score (9.8) with network attack vector and no user interaction. IBM remediation r...
Weak Password Vulnerability in Monitoring System of Kehua Data Co.
The main business of Kehua Data Co., Ltd. covers data center, high-end power supply and new energy, serving customers in more than 100 countries and regions around the world. A weak password vulnerability exists in the monitoring system of Kehua Data Corporation, which can be exploited by attacke...
The vulnerability of the `setLocateBeaconOnHardware` method in the HPE StoreOnce VSA virtual storage system allows a intruder to execute arbitrary code.
The vulnerability of the setLocateBeaconOnHardware method in the HPE StoreOnce VSA virtual storage system is related to the lack of measures taken to manage data at the management level. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...