CVE-2025-26167

Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...

CVE-2025-26167

Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...

PT-2025-9993

Name of the Vulnerable Software and Affected Versions Buffalo LS520D version 4.53 Description The issue allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files. Recommendations For Buffalo LS520D version 4.53, update to a newer version that contains a fix for...

CVE-2025-26167

The Buffalo LS520D network attached storage device is vulnerable to an arbitrary file read vulnerability in version 4.53 . This flaw allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files. A proof-of-concept exploit was published on March 6, 2025, and the vuln...

CVE-2025-26167

Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...

CVE-2025-26167: Exposure of Sensitive Information to an Unauthorized Actor

Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...

CVE-2024-54179

IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the...

Linux Distros Unpatched Vulnerability : CVE-2021-3427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as...

MAL-2025-2080 Malicious code in @roku-web-ui/legacy-nav-page-standard-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0fda134ffeb40092f3455e93def754a1f268e9e072daf6c275e9c40b35b1917 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-9326

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus versions 24.0.0 through 24.0.1 Description The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the...

CVE-2024-54179: Improper Neutralization of Input During Web Page Generation

IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2025-20116

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web...

Cisco APIC Multiple Vulnerabilities (cisco-sa-apic-multi-vulns-9ummtg5)

According to its self-reported version, Cisco Application Policy Infrastructure Controller is affected by multiple vulnerabilities. - A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could...

CVE-2025-20116

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web...

CVE-2025-20116

Cisco APIC’s web UI stores user-supplied input without proper validation, enabling an authenticated, remote attacker with valid admin credentials to perform a stored XSS on affected systems. The impact described includes execution of arbitrary script code in the web UI context and access to brows...

CVE-2025-20116 Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web...

CVE-2025-20116 Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web...

PT-2025-8731 · Cisco · Cisco Apic

Name of the Vulnerable Software and Affected Versions: Cisco APIC affected versions not specified Description: A stored XSS attack can be performed by an authenticated, remote attacker on the web UI of the system. The issue arises from improper input validation in the web UI, allowing an attacker...

PT-2025-8703 · Ibm · Ibm Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Data versions 4.0.0 through 4.8.5 IBM Cloud Pak for Data version 5.0.0 Description: The issue allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

CVE-2025-0719: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste...