CVE-2023-37658

CVE-2023-37658 affects fast-poster v2.15.0. The vulnerability is in the file upload path: ApiUploadHandler.post in /server/fast.py, where the image check is based on binary data and does not strictly verify the file suffix, enabling stored XSS. Several connected sources confirm this issue; exploi...

CVE-2024-56589

CVE-2024-56589 affects the Linux kernel’s scsi/hisi_sas path, where on no-forced preemption kernels an expander connected to 12 SAS SSDs could trigger a watchdog soft lockup due to interrupt handling on a single CPU. The provided details confirm the vulnerability’s root cause as a missing cond_re...

CVE-2024-25737

The Open Library Foundation VuFind software (versions 2.4 through 9.1 before 9.1.1) is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the /Cover/Show route, specifically within the showAction in CoverController.php. Due to improper input validation , a remote attacker can...

CVE-2023-41338

The CVE-2023-41338 issue affects gofiber (Fiber) prior to v2.49.2 where ctx.IsFromLocal() may return true for requests with X-Forwarded-For: 127.0.0.1, allowing access to localhost-scoped resources. Root cause: improper handling of the X-Forwarded-For header in the Ctx.IsFromLocal logic, enabling...

CVE-2023-41319

The CVE-2023-41319 vulnerability affects Fides versions 2.11.0–2.19.0, where the webserver API accepts ZIP uploads that may contain Python code executed in a sandbox that can be bypassed. An attacker with API access using the CONNECTOR_TEMPLATE_REGISTER scope (restricted in Admin UI to highly pri...

CVE-2023-3263

CVE-2023-3263 affects the Dataprobe iBoot PDU (firmware 1.43.03312023 and earlier). The vulnerability is an authentication bypass in the REST API caused by mishandling of special characters when parsing credentials, enabling an attacker to obtain a valid authorization token and read the relays/po...

CVE-2023-37957

CVE-2023-37957 affects Jenkins Pipeline restFul API Plugin up to version 0.11. A CSRF flaw allows an attacker to cause the Jenkins instance to connect to an attacker-controlled URL, enabling capture of a newly generated JCLI token. The vulnerability’s description and Red Hat/GitHub/NVD references...

CVE-2023-4917

CVE-2023-4917 (Leyka WordPress plugin) affects Leyka versions

CVE-2023-0925

Summary (CVE-2023-0925): Software AG webMethods OneData 10.11 is exposed with an embedded Azul Zulu Java 11.0.15 that runs a Java RMI registry on port 2099 and two RMI interfaces on a high, dynamically assigned port. An unauthenticated attacker with network access to these ports can instruct the ...

CVE-2023-26451

CVE-2023-26451 concerns Open-Xchange AppSuite’s integrated oAuth Authorization Service, which used a weak randomness source to generate authorization tokens. This made authorization codes predictable to third parties, enabling interception of the client authorization process and potential account...

CVE-2024-27005

The CVE-2024-27005 issue affects the Linux kernel interconnect driver: icc_lock and icc_bw_lock separation allowed races on icc_node::req_list, potentially leading to use-after-free or invalid pointer scenarios when icc_set_bw() iterates while req_list may be modified. The fix requires holding ic...

CVE-2023-37862

The CVE-2023-37862 entry concerns PHOENIX CONTACT WP 6xxx series web panels (versions prior to 4.0.10) with insufficient authorization in the HTTP API upload functions. An unauthenticated remote attacker can access the upload endpoints, which can lead to SSL certificate errors and may cause a par...

CVE-2023-3271

CVE-2023-3271 concerns the SICK ICR890-4, where an improper access control flaw allows an unauthenticated remote attacker to gather system information and download data via unauthenticated REST API endpoints. The issue is documented across multiple feeds (NVD, Red Hat, PRION, CNNVD, and Sick PSIR...

CVE-2023-37238

The CVE-2023-37238 entry concerns Huawei HarmonyOS. Affected component: wireless projection module (and related screen casting interfaces). Root cause: incomplete verification of apps’ permission to access a specific API, enabling insufficient permission checks. Impact: exploitation could affect ...

CVE-2023-36817

In CVE-2023-36817, the repository tktchurch/website (The King’s Temple Church website) version 0.1.0 exposed a Stripe API key in public code. The root cause is sensitive credentials accidentally committed to the codebase, enabling potential unauthorized financial transactions and access to custom...

CVE-2023-39951

CVE-2023-39951 affects OpenTelemetry Java Instrumentation prior to 1.28.0. When instrumenting AWS SDK v2 calls to SES v1, the request query parameters are inserted into the trace url.path, causing the HTTP body (subject and message) to be exposed in telemetry backends. This information disclosure...

CVE-2023-21410

CVE-2023-21410 affects the AXIS License Plate Verifier via the api.cgi endpoint, where user input is not sanitized, enabling arbitrary code execution. Public details (NVD) list a high-impact CVSSv3.1 score (base 8.8) with NETWORK attack vector, low attack complexity, and privileges required as lo...

CVE-2023-2746

Rockwell Automation Enhanced HIM is affected by CSRF due to an API that is not sufficiently protected and incorrect CORS settings. Exploitation could lead to sensitive information disclosure and full remote access to affected products. Judgment from multiple sources (ICS advisory ICSA-23-192-01, ...

CVE-2023-3131

CVE-2023-3131 affects the MStore API WordPress plugin prior to version 3.9.7. The vulnerability arises because most AJAX actions are not protected by privilege checks or nonce validation, enabling unauthorized actions such as modifying settings. Public references describe practical proof-of-conce...

CVE-2023-3209

CVE-2023-3209 affects the MStore API WordPress plugin prior to version 3.9.7, where many AJAX actions lack proper privilege checks and nonce validation, enabling unauthorized changes to settings (CSRF). Multiple sources corroborate an upstream issue that allows privilege escalation via crafted re...

CVE-2025-24500

The CVE-2025-24500 entry concerns Broadcom Symantec Privileged Access Management (PAM). Multiple connected sources confirm an unauthenticated attacker can access information in the PAM database. No concrete affected versions or root-cause details are provided in the documents; some sources (PT-20...

CVE-2024-54132

Summary: CVE-2024-54132 affects GitHub CLI (gh). When a user downloads a GitHub Actions workflow artifact named .. using gh run download, the artifact name and the --dir value determine the extraction path, causing files within the artifact to be extracted one directory higher than intended. This...

CVE-2021-38938

CVE-2021-38938 affects IBM Host Access Transformation Services (HATS) versions 9.6–9.6.1.4 and 9.7–9.7.0.3. The underlying issue is storing user credentials in plaintext, allowing a local user to read them. Reported by IBM/X-Force; CVSS base scores indicate confidentiality impactHigh with local a...

CVE-2023-39421

CVE-2023-39421 involves the RDPWin.dll component used by the IRM Next Generation booking engine, which contains hardcoded API keys for third‑party services (Twilio, Vonage). The root cause is hardcoded credentials in RDPWin.dll, enabling unrestricted interaction with these services. NVD assigns a...

CVE-2023-4740

CVE-2023-4740 affects IBOS OA 4.5.5, with a SQL injection in the Delete Draft Handler at the endpoint described as the unknown part of ?r=email/api/delDraft&archiveId=0. Multiple connected sources (NVD/NVD-derived, Red Hat, CVE lists, and PT Security) confirm remote exploitation potential and pub...

CVE-2023-32761

CVE-2023-32761 is a CSRF vulnerability in Archer Platform prior to version 6.13. An authenticated attacker can execute arbitrary code via a crafted request. The issue is fixed in Archer Platform versions 6.12.0.6 and 6.13.0. No exploitation details are provided beyond the authenticated vector; no...

CVE-2024-56630

The CVE-2024-56630 issue affects the Linux kernel’s ocfs2 subsystem: when ocfs2_get_init_inode() fails, inodes could be leaked due to not iput()'ing after new_inode() succeeds and dquot_initialize() fails. The syzbot trace mentions busy inodes after unmount for commit 9c89fe0af826 and that the er...

CVE-2023-40165

The CVE-2023-40165 entry concerns RubyGems.org, the Ruby community gem hosting service. The vulnerability arose from insufficient input validation that allowed replacement of uploaded gems whose platform, version, or gem name matched “/-\d/,” enabling a malicious upload to temporarily override a ...

CVE-2023-38617

Office Suite Premium v10.9.1.42602 is affected by a reflected cross-site scripting (XSS) vulnerability in the filter parameter of the API endpoint /api?path=files. The issue is documented across multiple sources, with no public exploit details provided in the attached documents. CVSS 3.1 base sco...

CVE-2023-39422

The CVE-2023-39422 issue affects the IRM Next Generation booking engine’s /irmdata/api/ endpoints. The root cause is that HMAC tokens used to authenticate requests are exposed in a client-side JavaScript file, which renders this extra safety mechanism ineffective. Descriptions across sources repe...

CVE-2023-37918

CVE-2023-37918 affects Dapr and describes an API-token authentication bypass in HTTP endpoints when API token authentication is enabled. The root cause involves health check endpoint allowlisting, where requests containing /healthz in the URL could bypass the dapr-api-token check and reach the Da...

CVE-2024-56707

The connected Astra Linux and MS/ENISA/Nessus entries confirm CVE-2024-56707 affects the Linux kernel octeontx2-pf driver and states the root cause as missing error pointer checks after otx2_mbox_get_rsp in otx2_dmac_flt.c. A fix adds error pointer validation after the call. The remediation is th...

CVE-2024-53164

In modes: NORMAL, this CVE (CVE-2024-53164) concerns the Linux kernel net/sched subsystem. The technical detail provided across connected advisories confirms the vulnerability lies in the ordering of qlen adjustments: sch->q.qlen changes around qdisc_tree_reduce_backlog() must occur before cal...

CVE-2023-25042

CVE-2023-25042 : Stored XSS in the oAuth Twitter Feed for Developers WordPress plugin (

CVE-2023-4559

CVE-2023-4559 affects Bettershop LaikeTui; the issue is in the POST Request Handler at index.php?module=api&action=user&m=upload, allowing unrestricted file upload. Root cause and details point to unknown affected versions due to rolling-release behavior; no version-specific fixes are disclosed i...

CVE-2023-26861

CVE-2023-26861 affects PrestaShop vivawallet, version 1.7.10 and earlier, where a SQL injection in the vivawallet() module could allow a remote attacker to gain privileges. The issue is tied to the vivawallet() integration and is documented across multiple sources; no publicly available fix versi...

CVE-2024-27816

The CVE-2024-27816 entry affects tvOS 17.5 (Apple TV) via the AppleMobileFileIntegrity component. A logic issue was addressed with improved checks, with the impact that an attacker may be able to access user data. Apple’s security content indicates this fix is part of tvOS 17.5, and related Apple...

CVE-2023-37600

Office Suite Premium affected product: Version v10.9.1.42602. Vulnerability: reflected cross-site scripting (XSS) via the id parameter at /api?path=profile. Root cause: input reflected back to output without adequate sanitization (per the provided CVE record and secondary sources). Impact (as des...

CVE-2023-1547

The CVE-2023-1547 entry concerns Elra Parkmatik (Parkmatik software) with an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. It allows SQL injection through SOAP parameter tampering and can lead to command line execution, affecting versions before 0...

CVE-2023-39423

CVE-2023-39423 affects RDPData.dll, where the /irmdata/api/common endpoint processes session IDs and other features. The underlying issue is improper neutralization of SQL commands, enabling a UNION-based SQL injection that can leak the sessions table and obtain currently valid sessions, allowing...

CVE-2023-3581

CVE-2023-3581 affects Mattermost. The issue is that the product fails to properly validate the origin of a websocket connection, which can allow a Man-In-The-Middle (MITM) attacker to access the websocket APIs. Concrete details across connected sources consistently describe this as an origin-vali...

CVE-2023-2759

TapHome core platform before version 2023.2 contains a hidden API vulnerability that lets an authenticated, low-privilege user change other users’ passwords, potentially giving full device access. This is documented across CVE-2023-2759 entries (NVD/Red Hat) and aligns with the vendor’s disclosur...

CVE-2023-3606

TamronOS (IPTV) contains a remote OS command injection in the /api/ping endpoint, caused by manipulation of the host parameter. Affects TamronOS versions up to 20230703; exploitation can be remote and the vulnerability has been publicly disclosed (CVE-2023-3606). The CVE entry notes no fix detail...

CVE-2023-3529

Rotem Dynamics Rotem CRM up to 20230729 contains an information-exposure issue in the OTP URI Interface, specifically the /LandingPages/api/otp/send?id=[ID]&method=sms endpoint. The vulnerability allows remote initiation and arises from a discrepancy in the handling of this API, with no public ex...

CVE-2023-37241

CVE-2023-37241 is an input verification vulnerability in the WMS API. Exploitation could cause the affected device to restart. The available connected sources confirm the issue and its impact but do not provide concrete exploit details, affected versions, or a validated fix/update. No remediation...

CVE-2023-36622

The affected product is Loxone Miniserver Go Gen.2 (prior to 14.1.5.9). The vulnerability is a command-injection flaw in the websocket configuration endpoint, where remote authenticated administrators can inject arbitrary OS commands via the timezone parameter. This impacts confidentiality, integ...

CVE-2025-67887

1C-Bitrix versions through 25.100.500 are vulnerable to Remote Code Execution (RCE) due to a lack of security checks when extracting archives in the Translate Module . An actor with SOURCE/WRITE permissions can upload a malicious archive containing a PHP file and a .htaccess file to execute arbit...

CVE-2025-25188

CVE-2025-25188 affects Hickory DNS (Rust-based DNS client/server/resolver). The vulnerability lies in DNSSEC validation: the routines may treat entire RRsets of DNSKEY records as trusted after establishing trust with a single DNSKEY, causing all keys in a zone to be trusted to authenticate other ...

CVE-2024-56644

CVE-2024-56644 concerns a leak in the Linux kernel IPv6 path: when an ICMPv6 MTU-change creates an expired exception dst in the IPv6 exception table, and a TCP connection uses that dst, the dst may leak as its refcount becomes unbalanced after ip6_negative_advice() runs. The description specifies...

CVE-2023-32760

CVE-2023-32760 affects Archer Platform prior to version 6.13, with fixes in 6.12.0.6 and 6.13.0. An authenticated attacker could access sensitive information via API calls related to data feeds and data publication. The vulnerability’s impact and exact exploited components are described in the li...