197809 matches found
DiviGear Carousel cross-site scripting vulnerability
DiviGear Carousel versions 5.2.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from the insufficient input cleaning and output escaping in the updatelicense AJAX operation. It may allow authenticated attackers with subscription or higher privileges to inject...
Apple iOS Buffer Overflow Vulnerability
Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple tvOS versions prior to 27, Apple visionOS versions prior to 27, and Apple watchOS versions prior to 27 have a buffer error vulnerability. This vulnerability stems from improper...
Advantech Adam-3600: Improper exception handling leads to vulnerabilities
The Advantech Adam-3600 versions prior to 2.8.5.0 have a vulnerability in exception handling. This vulnerability allows attackers to send specially crafted messages to trigger assertion failures, resulting in service crashes...
CodeWithCJ SparkyFitness Authorization Issue Vulnerability
Versions of CodeWithCJ SparkyFitness prior to 0.17.0 have a vulnerability related to authorization. This vulnerability arises from a lack of authorization checks. Authorized attackers can use the DELETE /api/foods/food-variants/:id endpoint to delete food variants for other users. They can also u...
Advantech Adam-3600 resource management error vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a resource management vulnerability. This vulnerability stems from issues with the batch port configuration function, which may allow unauthenticated attackers to cause the system to crash...
Apple iOS Authorization Issue Vulnerability
Versions of Apple’s iOS prior to version 27, Apple iPadOS prior to version 27, and Apple macOS Golden Gate prior to version 27 have authorization-related vulnerabilities. These vulnerabilities may allow applications to access sensitive user data...
Advantech Adam-3600 buffer error vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer overflow vulnerability. This vulnerability stems from a stack buffer overflow in the login function, which could allow attackers to execute arbitrary code...
Apache Tomcat resource management error vulnerabilities
The Apache Tomcat versions from 11.0.0-M23 to 11.0.26, from 10.1.27 to 10.1.60, and from 9.0.92 to 9.0.122 contain a resource management error vulnerability. This vulnerability arises due to incomplete cleanup, resulting in the leakage of information from the end of one request into subsequent...
Apple iOS Permission Licensing and Access Control Vulnerabilities
Versions of Apple’s iOS prior to version 27, Apple iPadOS prior to version 27, Apple macOS prior to Golden Gate version 27, Apple macOS prior to Tahoe version 26.7, and Apple VisionOS prior to version 27 have vulnerabilities related to permission licensing and access control. These vulnerabilitie...
Apache Tomcat race condition vulnerability
There are concurrency issues with Apache Tomcat versions 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, and 9.0.118 to 9.0.122. These issues stem from improper object recycling and reuse during HTTP/2 asynchronous Servlet processing, which may lead to confusion between requests and/or responses between...
WordPress WP User Manager Authorization Vulnerability
WordPress WP User Manager 2.9.25 and earlier versions have a vulnerability related to authorization. This vulnerability arises from a lack of authorization checks, which may lead to manipulation of user status...
Apple macOS Information Leakage Vulnerability
Apple macOS versions prior to Golden Gate 27, Apple macOS Sequoia 15.8, and Apple macOS Tahoe 26.7 have security vulnerabilities. These vulnerabilities stem from improper handling of secure input states, which may allow applications to access sensitive user data...
Apple iOS Resource Management Vulnerability
Apple iOS versions prior to 26.7, Apple iPadOS versions prior to 26.7, Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia 15.8 versions prior to 27, Apple macOS Tahoe versions prior to 26.7, Apple tvOS versions prio...
Advantech Adam-3600 command injection vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a command injection vulnerability. This vulnerability stems from command injection, and it may allow authenticated attackers to execute root-level code on the system...
Apple macOS Authorization Issues Vulnerability
Versions of Apple macOS Golden Gate prior to version 27 have a licensing issue vulnerability. This vulnerability stems from state management issues, which may allow applications to access sensitive user data...
Apache Tomcat buffer error vulnerability
The Apache Tomcat 11.0.0-M25 version to 11.0.26 version has a buffer overflow vulnerability. This vulnerability stems from a buffer underflow, where large non-blocking writes may cause the response body to be split between the current request and the next request on that connection. This results ...
Apple macOS Information Leakage Vulnerability
Versions of Apple macOS Golden Gate prior to version 27 have a vulnerability related to information leakage. This vulnerability stems from an imperfect privacy check mechanism, which may allow applications to access sensitive user data...
Apple iOS Buffer Overflow Vulnerability
Apple iOS versions prior to 26.7, Apple iPadOS versions prior to 26.7, Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia versions prior to 15.8, Apple macOS Tahoe versions prior to 26.7, and Apple VisionOS versions...
Agent2Agent A2A Java SDK Trust Management Vulnerability
The Agent2Agent A2A Java SDK versions from 1.3.0.Final to 1.3.2.Final contain a trust management issue. This issue arises because the AndroidA2AHttpClient’s synchronous POST path overrides the disabled redirection settings. Additionally, JSONRPCTransport and RestTransport send synchronous request...
XERJ Organization: XERJ Authorization Issues Vulnerability
The XERJ v1.0.0-rc.11 version has an authorization issue vulnerability. This vulnerability arises from the Bearer token being able to bypass the identity verification requirements of the restricted access key and directly call the API token to create endpoints. This may lead to the generation of...
WordPress Participants Database Authorization Issue Vulnerability
The WordPress Participants Database versions 2.7.8.5 and earlier have an authorization issue vulnerability. This vulnerability stems from bypassing authorization through user control keys, which may lead to exploitation if the access control security levels are configured improperly...
Apple iOS Buffer Overflow Vulnerability
Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple tvOS versions prior to 27, Apple visionOS versions prior to 27, and Apple watchOS versions prior to 27 have a buffer error vulnerability. This vulnerability stems from improper...
Advantech Adam-3600 authorization issue vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have an authorization vulnerability. This vulnerability stems from a proprietary protocol that has authentication bypass issues, which may allow attackers to circumvent the authentication mechanism...
Apple iOS Buffer Overflow Vulnerability
Apple iOS versions prior to 26.7, Apple iPadOS versions prior to 26.7, Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia 15.8 versions prior to 27, Apple macOS Tahoe versions prior to 26.7, Apple tvOS versions prio...
WordPress Meta Box – WordPress Custom Fields Framework Authorization Issue Vulnerability
WordPress Meta Box – WordPress Custom Fields Framework: Versions 5.15.2 and earlier have a licensing issue vulnerability. This vulnerability stems from an absence of proper authorization, which may allow attackers to exploit improperly configured access control levels...
WordPress SureCart cross-site scripting vulnerabilities
WordPress SureCart 4.9.5 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and it may lead to storage-based cross-site scripting attacks...
Advantech Adam-3600 authorization issue vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have an authorization issue vulnerability. This vulnerability stems from problems with the password reset mechanism, which may allow attackers to bypass the authentication mechanism...
Apple macOS Permission Licensing and Access Control Vulnerabilities
Versions of Apple macOS prior to Golden Gate 27, Apple macOS Sequoia prior to 15.8, and Apple macOS Tahoe prior to 26.7 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper access control mechanisms, which may allow applications to acce...
WordPress Brizy Cross-Site Script Vulnerability
WordPress Brizy 2.8.23 has a cross-site scripting vulnerability, which stems from improper input during web page generation. This vulnerability may lead to storage-based cross-site scripting attacks...
Advantech Adam-3600 buffer error vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer overflow vulnerability. This vulnerability stems from the FileProcess::CheckDir function, which has a stack-based buffer overflow. A remotely authenticated attacker can execute arbitrary code by using a path that exceeds 1024 bytes...
Apple macOS race condition bug
Apple macOS Golden Gate 27 and earlier versions, Apple macOS Sequoia 15.8 and earlier versions, as well as Apple macOS Tahoe 26.7 and earlier versions have a vulnerability due to a race condition. This vulnerability may allow malicious applications to bypass privacy preferences settings...
Academy Software Foundation OpenImageIO Digital Error Vulnerability
The Academy Software Foundation’s OpenImageIO versions prior to 3.0.20.0, as well as versions 3.1.15.0 and earlier i.e., 3.1.x series, and 3.2.0.3-beta1 and earlier i.e., 3.2.x series, contain a numerical error vulnerability. This vulnerability stems from an integer overflow in the...
Apache Tomcat resource management error vulnerabilities
The Apache Tomcat versions from 11.0.0-M21 to 11.0.26, from 10.1.25 to 10.1.60, and from 9.0.90 to 9.0.122 contain a resource management error vulnerability. This vulnerability arises due to incomplete cleanup processes, which may cause intermittent failures in TLS 1.3 connections...
Apple iOS Buffer Overflow Vulnerability
Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple tvOS versions prior to 27, Apple visionOS versions prior to 27, and Apple watchOS versions prior to 27 have a buffer error vulnerability. This vulnerability stems from improper...
Advantech Adam-3600 code injection vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a code injection vulnerability. This vulnerability stems from code injection, and it may allow remotely authenticated attackers to execute arbitrary code with service privileges...
Advantech Adam-3600 path traversal vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a path traversal vulnerability. This vulnerability allows for attacks where path traversal is possible, potentially enabling authenticated attackers to access any file on the system...
Advantech Adam-3600 buffer error vulnerability
The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer error vulnerability. This vulnerability stems from issues with heap memory reading, which may allow attackers to disclose sensitive data...
OpenCATS Authorization Issue Vulnerability
Versions of OpenCATS prior to 0.10.0 have an authorization issue. This vulnerability stems from the absence of authorization checks in the ajax/deleteActivity.php and ajax/editActivity.php files. Authorized READ-level users can use GET or POST requests to provide any activity ID, allowing them to...
Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability
Apostrophe Technologies’ ApostropheCMS versions prior to 4.33.0 have a vulnerability related to authorization. This vulnerability arises from the lack of applying viewRole to anonymous visitors, and insufficient template restrictions. When developers expose user objects through publicly rendered...
FacturaScripts Cross-Site Scripting Vulnerabilities
FacturaScripts version 2025.61 has a cross-site scripting vulnerability. This vulnerability arises from the application returning different responses for login requests with valid and invalid usernames. Unauthenticated attackers can enumerate valid usernames by analyzing differences in response...
LavaLite authorization issue vulnerability
LavaLite 10.1.2 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the Filer module lacking authentication. Unauthorized attackers can provide arbitrary disk names and paths through the filer/download and filer/display routes, allowing them to retrieve...
Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability
Apostrophe Technologies ApostropheCMS has an authorization issue vulnerability. This vulnerability stems from the lack of authentication and authorization checks in the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export. This allows unauthorized users, including those who obtain...
TYPO3 Analytics authorization issue vulnerability
Versions of TYPO3 Analytics prior to 1.1.1 have an authorization issue vulnerability. This vulnerability arises from the backend module not checking whether the backend user has permission to access the requested site. As a result, users who have permission to access this module may open the...
Fastify fast-uri: Vulnerability due to improper output processing
Versions of Fastify prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 contain security vulnerabilities. These vulnerabilities arise when the serialize, normalize, or resolve methods are used with a reference option set to a value other than the default suffix, and when the referenced...
Eclipse ThreadX – NetX Duo input validation vulnerability
Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a security vulnerability. This vulnerability stems from the X.509 parser in NetX Secure accepting RSA public keys of arbitrary size and decrypting them into a fixed-size buffer. Certificates with larger modulus values may lead to...
tox-dev filelock: Processing logic error vulnerability
The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...
Mozilla Firefox: Vulnerability Due to Improper Exception Handling
Mozilla Firefox has a vulnerability related to improper exception handling. This vulnerability stems from an issue with the Audio/Video: cubeb component, where uninitialized memory is present, which may lead to information leakage...
SolarWinds Observability Self-Hosted Authorization Issue Vulnerability
SolarWinds Observability Self-Hosted versions 2026.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from defects in the authorization mechanism, which may allow low-privilege users to access and modify information beyond their permission scope...
Apple macOS Information Leakage Vulnerability
Versions of Apple macOS Golden Gate prior to version 27 have a vulnerability known as information leakage. This vulnerability arises from the removal of code that contained the vulnerability, which may lead to the application leaking kernel memory...
Coze-Dev and Coze-Studio: Configuration error vulnerabilities
Versions of coze-dev and coze-studio before 0.5.0 have a configuration error vulnerability. This vulnerability stems from insecure default configurations, allowing any registered user to execute commands in unshaded Python3 subprocedures by running workflow code nodes. Attackers can bypass the...