190 matches found
CVE-2018-19276
CVE-2018-19276 إلغاء تسلسل الكائنات غير الآمن في OpenMRS RCE من https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 يسمح إلغاء تسلسل الكائنات غير الآمن بتنفيذ تعليمات برمجية عشوائية دون الحاجة إلى تسجيل الدخول. قيود IP على وحدة خدمات الويب لا تمنع هذا الهجوم. جمي...
proofpoint-CVE-2023-0090
के बारे में सुरक्षा शोधकर्ता: ly1g3, ly1g3attuta.io GPG फिंगरप्रिंट: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 अवलोकन: रिमोट कोड निष्पादन - अप्रमाणित RCE CVE: CVE-2023-0090 समयरेखा: खोजा गया - ly1g3 रिपोर्ट किया गया - ly1g3 ठीक किया गया - Proofpoint...
Blackash-CVE-2025-61757
🚨 CVE-2025-61757 — प्रमाणीकरण-पूर्व RCE अलर्ट 🚨 🧩 सारांश आईडी: CVE-2025-61757 उत्पाद: Oracle Identity Manager Oracle Fusion Middleware घटक: REST वेबसेवाएँ प्रभावित संस्करण: 12.2.1.4.0 और 14.1.2.1.0 गंभीरता: 🔴 गंभीर — 9.8 CVSS 3.1 प्रकाशित: 21 अक्टूबर, 2025 प्रकार: महत्वपूर्ण फ़ंक्शन के लिए गुम...
CVE-2026-14466 Possible XSS in the SNS web administration panel
It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...
CVE-2026-14466
Stormshield SNS is vulnerable to a stored XSS in its web administration panel. An SNS administrator with appropriate permissions can inject a malicious script into a group's comments within the webservices administration interface , leading to execution in the context of other users. The CVSS v3....
CVE-2026-14466 Possible XSS in the SNS web administration panel
It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...
CVE-2026-14466: Improper Neutralization of Input During Web Page Generation
It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...
PT-2026-85534
It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...
CVE-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...
CVE-2026-72532
Joomla! Core (versions 4.0.0–5.4.7 and 6.0.0–6.1.2) contains an improper access control check in category webservice endpoints, allowing users with high privileges to create categories they should not be authorized to. CVSS 4.0 scores it MEDIUM (5.1) with network attack vector. The Joomla securit...
PT-2026-80763
Name of the Vulnerable Software and Affected Versions resdata versions prior to 6.2.9 Description The software fails to correctly validate input within GRDECL files. This issue is particularly critical when the tool is used to parse untrusted files in networking contexts, such as webservices...
CVE-2026-60560
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-62602
Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the REST WebServices component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...
CVE-2026-60560: Improper Access Control
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
CVE-2026-36035
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...
CVE-2026-36035: Improper Access Control
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...
CVE-2026-36035
The CAXPerts UniversalPlantViewer WebServices Server v2.7.6 is affected by an incorrect access control vulnerability in the /api/License/deactivateOffline endpoint. This flaw allows authenticated attackers with low-level privileges to perform a Denial of Service (DoS) attack by removing the licen...
Exploit for Eval Injection in Proofpoint Enterprise_Protection
About Security researcher: ly1g3, ly1g3attuta.io GPG finge...
Joomla 3.0.x < 5.4.7 / 6.0.x < 6.1.2 Multiple Vulnerabilities (joomla-6-1-2-5-4-7-security-bugfix-release)
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 5.4.7 or 6.0.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities. - An improper access check allows unauthorized users to create custom fields via webservices...