DataElem BISHENG Authorization Issue Vulnerability

DataElem BISHENG 3.0.0-beta4 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references, which may allow authenticated low-privilege users to read other users’ parsed documents by providing arbitrary fileid values. It also allow...

BMC Helix Network Management Authorization Issues Vulnerability

Versions of BMC Helix Network Management prior to 26.3.01 have an authorization issue vulnerability. This vulnerability stems from the bypass of authentication when configuring SAML single-sign-on. Unverified attackers can log in as a local administrator using any password. By submitting an...

Google Chrome Resource Management Error Vulnerability

Versions of Google Chrome prior to 155.0.8059.84 have a resource management vulnerability. This vulnerability stems from the use of reusing V8 objects after they are released, which may allow remote attackers to execute arbitrary code within a sandbox through a specially crafted HTML page...

Apache Airflow Permission Authorization and Access Control Vulnerabilities

Versions of Apache Airflow prior to 0.11.1 have vulnerabilities related to permission granting and access control. This vulnerability stems from the attachteampermissions function in the multi-team configuration, which grants global read access to audit logs for each team role. This could allow...

EasySoft Zentaopms Authorization Issue Vulnerability

EasySoft ZentaOPMS versions 22.6 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass in the action::editComment function. Certified users can read and modify comments on products and projects that they do not have access to by providing any actio...

CRMEB authorization issue vulnerabilities

The CRMEB version 5.6.1 to 6.0.0 contains an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the gift-order API. It allows authenticated store users to read and claim orders of other users. An attacker can enumerate consecutive order IDs in th...

JetBrains Junie CLI software supply chain issue vulnerabilities

Versions of JetBrains Junie CLI prior to version 26.8.3 have vulnerabilities related to the software supply chain. These vulnerabilities stem from misconfigured MCP servers in untrusted projects, which may lead to code execution...

Dave Nardella Snap7 OFFICIAL Buffer Error Vulnerability

Dave Nardella Snap7 OFFICIAL versions 1.4.3 and earlier contain a buffer error vulnerability. This vulnerability stems from the lack of checking of the DataLength field in TSnap7 OFFICIAL MicroClient::opReadArea. This allows out-of-buffer writing, enabling malicious S7 peers to overflow the clien...

Google Chrome buffer error vulnerability

Versions of Google Chrome prior to 155.0.8059.84 contain a buffer overflow vulnerability caused by core memory corruption. This vulnerability could allow remote attackers to read memory through specially crafted HTML pages...

JetBrains DataloR path traversal vulnerability

Versions of JetBrains DataLore prior to 2026.2.1 have a path traversal vulnerability. This vulnerability stems from unauthenticated path traversal through the report blob endpoint, which may lead to the reading of arbitrary files...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

Google Chrome: Input validation error vulnerability

Versions of Google Chrome prior to 155.0.8059.84 contain a vulnerability related to input validation. This vulnerability arises from improper input validation, and it could allow remote attackers to execute arbitrary code outside of the sandbox through a specially crafted HTML page...

jxxghp MoviePilot prompt injection vulnerability

Jxxghp MoviePilot versions 3.1.5 and earlier have a vulnerability related to prompt injection. This vulnerability arises when tools such as browsewebpage, searchweb, and torrent metadata parser process unreliable content, embedding malicious instructions. These contents are transmitted through...

Ivanti Connect Secure software supply chain issue vulnerabilities

The Ivanti Connect Secure version 22.8R2.4 has a software supply chain vulnerability. This vulnerability stems from the improper handling of trust in DSCache configuration data by the dsinvoked broker, which may lead to permission escalation to root access...

Google Chrome buffer error vulnerability

Versions of Google Chrome prior to 155.0.8059.84 have a buffer overflow vulnerability. This vulnerability stems from memory corruption in Workers, which could allow remote attackers to execute arbitrary code within the sandbox through a specially crafted HTML page...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

WordPress Sunshine Photo Cart authorization issue vulnerability

WordPress Sunshine Photo Cart versions 3.7.4 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the Microsoft Office Word component, which could allow unauthorized attackers to leak information through the network...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute arbitrary code through the network...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

APITable Authorization Issue Vulnerability

APITable 1.14.0-beta and earlier versions have an authorization issue. This vulnerability stems from an authorization bypass, allowing authenticated users to read node descriptions of other spaces by providing a user-controllable nodeId. When a GET request is made to /node/nodeId/description, the...

Libraw buffer error vulnerability

Libraw versions 0.22.2 and earlier have a buffer error vulnerability. This vulnerability stems from a stack-based out-of-bounds read in LibRaw::parseNikonMakernote. An attacker could provide a custom Nikon NEF/TIFF file with a 5-byte ShotInfo tag labeled with version 243. By reading the...

WordPress Post Export Import with Media: Deserialization Injection Vulnerability

WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...

Jordan Harband: Improper exception handling leads to vulnerabilities

Jordan Harband versions from 6.7.0 to 6.16.1 have security vulnerabilities. This vulnerability arises from improper string coercion of array elements when using arrayFormat with a comma. When elements cannot be converted to strings, a type error will occur, potentially allowing unverified attacke...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – Calendar Booking Plugin for Appointments and Events. Versions 5.7.3 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of ownership checks on the bookingid and cartid parameters. Unauthorized attackers can enumerate booking or cart identifiers...

lmfit ASTEVAL processing logic error vulnerability

The lmfit ASTEVAL version prior to 1.0.9 has security vulnerabilities. These vulnerabilities stem from the default interpreter, which exposes the ctypes type when numpy is enabled. This allows access to memory through the fromaddress function. The safegetattr function does not intercept objects...

WordPress FluentBoards authorization issue vulnerability

WordPress FluentBoards versions 2.1.0 and earlier have a licensing issue vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

Siemens RUGGEDCOM CROSSBOW authorization issue vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have an authorization issue vulnerability. This vulnerability stems from the failure to properly restrict access to sensitive configuration items through specific database queries. As a result, authenticated attackers may obtain administrative...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of the input values for the Name and Value fields of custom file tags. This allows attackers with authenticated and administrator privileges to...

The-40-Thieves obsidian-tc information leakage vulnerability

The The-40-Thieves obsidian-tc version prior to 1.3.1 has security vulnerabilities. These vulnerabilities stem from the bridge tool not applying a read access control list to each returned field consistently. The tasksfilter tool exposes the group count for notes that are denied access. The...

Ravi Teja Online-Examination-System Processing Logic Vulnerability

Ravi Teja Online-Examination-System has a processing logic vulnerability. This vulnerability stems from the Session::checkLogin function in the include/session.php file within the Session Handler component. The function manipulates the parameters cookname/cookid, leading to incorrect comparisons...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of inputs when processing facility names in batch import/export workflows. It may allow authenticated attackers with specific privileges to execute...

TechSmith MP4V2 has vulnerabilities related to improper exception handling.

The Techsmith MP4V2 2.0.0 version has a vulnerability in exception handling. This vulnerability stems from a null pointer dereferencing in the src/mp4file.cpp function, MP4File::GenerateTracks. This could allow a remote attacker to cause a denial-of-service attack...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform’s Parse Server versions from 8.2.2 to 8.6.94 and from 9.0.0 to 9.10.1-alpha.14 contain authorization issue vulnerabilities. This vulnerability stems from GraphQL implicit control, which only applies to operations where requests are sent directly. It does not cover operations...

JupyterHub processing logic vulnerability

JupyterHub 6.0.1 and earlier versions have a processing logic vulnerability caused by identifier conflicts. Users who have been authenticated can override another user’s named server OAuth client by using hyphenated usernames. For example, a user with the username “alice-prod” can override the...

Konstanty Bialkowski libmodplug resource management error vulnerability

The Konstanty Bialkowski libmodplug versions 0.8.9.0 and 0.8.9.1 have a resource management vulnerability. This vulnerability arises from manipulation of the abcaddgchord function in the file src/loadabc.cpp within the ABC Music Format Parser component, resulting in excessive resource consumption...

Hatchet Resource Management Error Vulnerability

Hatchet versions 0.110.5 and earlier have a resource management vulnerability. This vulnerability stems from unlimited resource allocation. Unauthenticated attackers can send arbitrary or concurrent request bodies via the SNS ingestion endpoint to POST /api/v1/sns/tenant/event. The SnsUpdate...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 7.1 to 7.1.10 contain security vulnerabilities. These vulnerabilities stem from the use of the zcryptmsgtype6sendep11cprb function, which accesses and modifies the domain field in the EP11 CPRB payload by using a vulnerable struct overlays. Additionally, proper...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability that stems from the lack of verification for allocated pointers in opteeffalendprotmem, which may lead to null pointer dereferencing...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.16 to 6.18.57, 7.1.10 before the release, and 7.2 before the release contain security vulnerabilities. These vulnerabilities stem from the release of the AEAD conversion in RCU callbacks. The cryptofreeaead function may become dormant, which could lead to calls to...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions from 2.6.12 to 6.18.57, as well as versions from 2.6.12 to 7.1.10 and from 2.6.12 to 7.2. The vulnerability stems from the ipvsnaticmp function in ipvs, which does not re-validate the ihl field in the embedded IP header read from the sk...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.12.34 to 6.12.74 contain security vulnerabilities. This vulnerability arises from the use of Threaded NAPI in WireGuard devices, which causes the decryption process to completely stop under high network load, potentially leading to a denial-of-service attack...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the drm/xe/dma-buf module not properly handling the release of objects during the retry loop, which may lead to reuse after release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.15 contains security vulnerabilities. These vulnerabilities stem from a double release issue in the tipcbuf.Append function, which may lead to memory corruption...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 contains security vulnerabilities. These vulnerabilities stem from the bonding driver’s improper implementation of RCU rules in 3ad mode, which may lead to data races...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.115 contained a security vulnerability caused by a heap buffer overflow in the GPU. This vulnerability could allow a remote attacker with access to the renderer process to execute a sandbox escap...