lmfit ASTEVAL processing logic error vulnerability

The lmfit ASTEVAL version prior to 1.0.9 has security vulnerabilities. These vulnerabilities stem from the default interpreter, which exposes the ctypes type when numpy is enabled. This allows access to memory through the fromaddress function. The safegetattr function does not intercept objects...

Ravi Teja Online-Examination-System Processing Logic Vulnerability

Ravi Teja Online-Examination-System has a processing logic vulnerability. This vulnerability stems from the Session::checkLogin function in the include/session.php file within the Session Handler component. The function manipulates the parameters cookname/cookid, leading to incorrect comparisons...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...

Siemens RUGGEDCOM CROSSBOW information leakage vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a vulnerability related to information leakage. This vulnerability stems from insufficient restrictions on access to various database queries. It may allow authenticated attackers to retrieve system-wide information beyond their authorized...

LeapWorx Premium Addons for Elementor: Authorization Issues and Vulnerabilities

LeapWorx Premium Addons for Elementor 4.11.110 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization, which may lead to exploitation by incorrectly configured access control levels...

Xorbits Xoscar deserialization injection vulnerability

Xorbits Xoscar versions 0.11.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from the use of SocketChannel.recv, which passes unvalidated data to cloudpickle.loads. This triggers the pickle reduce utility before message type validation. Unauthorized remote...

The-40-Thieves obsidian-tc information leakage vulnerability

The The-40-Thieves obsidian-tc version prior to 1.3.1 has security vulnerabilities. These vulnerabilities stem from the bridge tool not applying a read access control list to each returned field consistently. The tasksfilter tool exposes the group count for notes that are denied access. The...

NETGEAR CBR40 has a vulnerability related to input validation errors.

NETGEAR CBR40, R7000 v1.0.11.130 earlier versions, R7000P V1.3.3.152 earlier versions, and RAX40 V1.0.3.64 earlier versions have a vulnerability related to input validation errors. This vulnerability stems from insufficient input validation in the Time Server NTP settings. It may allow attackers...

WordPress FluentBoards authorization issue vulnerability

WordPress FluentBoards versions 2.1.0 and earlier have a licensing issue vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

Jumpserver code injection vulnerability

Versions of Jumpserver 4.10.17-lts and earlier contain a code injection vulnerability. This vulnerability stems from automated rendering based on Ansible, which allows attackers to evaluate template expressions under their control. Attackers with permission to create or execute affected automated...

Adobe Commerce code injection vulnerability

Adobe Commerce has a code injection vulnerability, which stems from improper handling of special elements used in the template engine. This vulnerability may allow arbitrary code to execute, enabling attackers to gain elevated access or control over the victim’s account or session without requiri...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

The-40-Thieves obsidian-tc backend link vulnerability

The The-40-Thieves obsidian-tc versions before 1.3.1 have a security vulnerability. This vulnerability stems from reading the access control list, where the check for lexical paths includes checking resolved paths as well. This allows symbolic links within libraries that are allowed by wildcarded...

Microsoft SQL Server resource management error vulnerabilities

Microsoft SQL Server has a resource management vulnerability that arises from insufficient or ineffective restrictions on resource allocation. This vulnerability could allow authorized attackers to cause denial-of-service attacks through the network...

MikroTik RouterOS Authorization Issues Vulnerability

MikroTik RouterOS versions 7.0.0 to 7.24.5 have a vulnerability related to authorization. This vulnerability stems from improper authorization checks in the WinBox authentication process. Remotely authenticated users with low privileges can obtain full management access by specifying a...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform’s Parse Server versions from 8.2.2 to 8.6.94 and from 9.0.0 to 9.10.1-alpha.14 contain authorization issue vulnerabilities. This vulnerability stems from GraphQL implicit control, which only applies to operations where requests are sent directly. It does not cover operations...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.95, as well as versions from 9.0.0 to 9.10.2-alpha.3, have a vulnerability related to improper exception handling. This vulnerability arises from the lack of parsing of URL references in files when objects are passed to Cloud Code triggers...

mher flower Cross-Site Request Forgery Vulnerability

Mher Flower versions prior to 2.2.0 had a cross-site request forgeing vulnerability. This vulnerability stemmed from the Tornado xsrfcookies being disabled and the absence of the SameSite header in OAuth session cookies. This made it vulnerable to cross-site request forgeing attacks. Attackers...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform, versions prior to 8.6.93 and 9.0.0 up to 9.10.1-alpha.13, have an authorization issue vulnerability. This vulnerability stems from the lack of enforcing the identity scope’s protectedFields during count queries using the $relatedTo operator. As a result, the size of the...

Hyper-MCP encryption issue vulnerabilities

Hyper-MCP versions 0.8.3 and earlier have an encryption-related vulnerability. This vulnerability stems from the fact that cosignverifyargs accepts any signer identity and OIDC issuer by default. Improper signature verification may allow attackers to load malicious WebAssembly plugins, which can...

Highwarden Super Store Finder has a vulnerability in input validation.

Highwarden Super Store Finder versions 3.8 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of the parameters lat/lng in the file /products/superstorefinder/index.php, which may lead to SQL injection attacks...

JupyterHub processing logic vulnerability

JupyterHub 6.0.1 and earlier versions have a processing logic vulnerability caused by identifier conflicts. Users who have been authenticated can override another user’s named server OAuth client by using hyphenated usernames. For example, a user with the username “alice-prod” can override the...

Hatchet Resource Management Error Vulnerability

Hatchet versions 0.110.5 and earlier have a resource management vulnerability. This vulnerability stems from unlimited resource allocation. Unauthenticated attackers can send arbitrary or concurrent request bodies via the SNS ingestion endpoint to POST /api/v1/sns/tenant/event. The SnsUpdate...

Konstanty Bialkowski libmodplug resource management error vulnerability

The Konstanty Bialkowski libmodplug versions 0.8.9.0 and 0.8.9.1 have a resource management vulnerability. This vulnerability arises from manipulation of the abcaddgchord function in the file src/loadabc.cpp within the ABC Music Format Parser component, resulting in excessive resource consumption...

WordPress MultiVendorX Authorization Issues Vulnerability

WordPress MultiVendorX 5.0.19 and earlier versions have a vulnerability related to authorization. This vulnerability arises from improper authorization settings. Attackers with the storeowner role can send POST requests via the settings REST endpoint, limited only by the editstores permission,...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

InnoShop input validation error vulnerability

InnoShop version 0.9.2 has a vulnerability in input validation. This vulnerability stems from improper handling of the source parameter in the AI Core MCP fileUpload tool. It allows authenticated administrators with the filescreate permission to use the file:// or php:// stream wrapper to read...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

Themegoods Grand News Authorization Issue Vulnerability

Themegoods Grand News versions 3.4 and earlier have a vulnerability related to authorization issues. This vulnerability arises because unverified attackers can exploit improper access control mechanisms, allowing unauthorized modifications to data...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...

WordPress GeoDirectory code injection vulnerability

WordPress GeoDirectory 2.8.187 and earlier versions have a code injection vulnerability. This vulnerability stems from the designtype parameter, which involves local file inclusion. It may allow unauthenticated attackers to include and execute any.php file on the server, thereby bypassing access...

WordPress Booking System SQL Injection Vulnerability

The WordPress Booking System 2.1.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from insufficient escaping of the currentmonth parameter provided to users, as well as inadequate preparation of existing SQL queries. This leads to time-based SQL injections...

John Broadway Pacioli authorization issue vulnerability

In versions of John Broadway Pacioli from 0.9.6 to 0.10.0, there is an authorization issue vulnerability. This vulnerability stems from the Pacioli-Guard documentation layer not checking whether the consent marker has been authorized for cancellation. This allows nested cancellation operations to...

Illumos-Gate resource management error vulnerability

The illumos-gate vulnerability involves a resource management issue. This vulnerability stems from the switcher function in the nscd frontend code located at usr/src/cmd/nscd/nscdfrontend.c. This function does not properly close file descriptors that are passed through the doorcall function but a...

Hayat Health Facilities Hayat Mobile Authorization Issue Vulnerability

Hayat Health Facilities Hayat Mobile versions 3.3.0 to 3.4.0 had an authorization issue vulnerability. This vulnerability stemmed from the use of client authentication, which could lead to authentication bypasses...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has security vulnerabilities. These vulnerabilities arise from the rejection of legitimate CA certificates, which may lead to denial-of-service attacks...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has security vulnerabilities. These vulnerabilities stem from a failure to reject X.509 certificates that contain contradictory combinations of key usage KU and extended key usage EKU. This could allow attackers to obtain sensitive information...

GnuTLS security vulnerabilities

GnuTLS version 3.8.13 has a security vulnerability. This vulnerability stems from improper certificate verification, causing the application to reject legitimate certificates of legitimate users, potentially leading to denial-of-service attacks...

Splunk Enterprise processing logic error vulnerability

Versions of Splunk Enterprise prior to 10.4.3, 10.2.7 prior to version 10.2.7, 10.0.10 prior to version 10.0.0, and 9.4.15 prior to version 9.4.15 have a processing logic vulnerability that stems from a failure of the protection mechanism...

Splunk Enterprise: Permissions licensing and access control issues

Versions of Splunk Enterprise prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper access control mechanisms, which may allow unauthorized access...

Splunk Enterprise resource management error vulnerability

Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 have a resource management vulnerability caused by improper control of the resource lifecycle...

Foreman permission and access control vulnerabilities

Foreman has vulnerabilities related to permission checks and access control. These vulnerabilities stem from improper permission verification by the template preview endpoint. As a result, authenticated users with low-level Viewer permissions can submit requests to obtain sensitive data such as t...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability stems from libsoup’s failure to properly limit the total size of WebSocket messages when reassembling them into GByteArray objects. A remote attacker can send specially crafted fragments, leading to size truncation and ultimate...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer error vulnerability. This vulnerability arises from the handling of incoming WebSocket Pong frames. SoupWebsocketConnection sends the ::pong signal using a GByteArray pointer. Since this signal is declared to be passed as GBytes, processes that follow the GBytes API may...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability arises when the max-incoming-payload-size is set to infinity 0. In such cases, libsoup’s SoupWebsocketConnection will expand the incoming GByteArray based on the length of the frame controlled by the attacker. This can lead to ...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability arises because when libsoup constructs WebSocket client frames for extremely large outbound payloads, the size value passed to the GByteArray allocation API may be truncated. However, the masking routine still uses the full...

Ali A. Saleem Anchorme.js Resource Management Error Vulnerability

Ali A. Saleem: Anchorme.js 3.0.8 and earlier versions have a resource management vulnerability. This vulnerability arises from catastrophic backtracking during the extraction of regular expressions from IPv6 hosts, which can lead to Regular Expression Denial-of-Service attacks. Attackers can...

Cockpit Files: Race Condition Issues

The Cockpit Files vulnerability involves a race condition issue. This issue arises due to a race condition occurring when the cockpit-files directory is created and its owner is assigned. Local, low-privilege attackers can exploit this by controlling the writable parent directory. By replacing th...