470477 matches found
EUVD-2026-102007
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5...
EUVD-2026-102005
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...
EUVD-2026-102003
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash...
EUVD-2026-102002
A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...
EUVD-2026-102001
A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...
EUVD-2026-102000
Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5...
EUVD-2026-101999
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...
EUVD-2026-101998
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow...
EUVD-2026-101997
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow...
EUVD-2026-101996
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...
EUVD-2026-101995
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
EUVD-2026-101994
Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...
EUVD-2026-101993
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within...
EUVD-2026-101992
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow...
EUVD-2026-101991
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...
EUVD-2026-101990
A cross-site scripting XSS vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP...
EUVD-2026-101989
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...
EUVD-2026-101987
In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...
EUVD-2026-101988
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...
EUVD-2026-101986
A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...
EUVD-2026-101985
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...
EUVD-2026-101984
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...
EUVD-2026-101983
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...
EUVD-2026-101982
An improper link resolution before file access 'link following' vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in...
EUVD-2026-101981
An unix symbolic link symlink following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 a...
EUVD-2026-101980
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
EUVD-2026-101979
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...
EUVD-2026-101978
An unix symbolic link symlink following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync...
EUVD-2026-101977
A server-side request forgery SSRF vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312...
EUVD-2026-101976
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
EUVD-2026-101975
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...
EUVD-2026-101974
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...
EUVD-2026-101973
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
EUVD-2026-101972
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
EUVD-2026-101971
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...
EUVD-2026-101970
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow...
EUVD-2026-101969
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...
EUVD-2026-101954
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
EUVD-2026-101953
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior...
EUVD-2026-101952
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100...
EUVD-2026-101951
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...
EUVD-2026-101950
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life...
EUVD-2026-101949
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier userId and the status of the authentication process validSteps in this cookie and relies on these...
EUVD-2026-101948
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition...
EUVD-2026-101947
When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...
EUVD-2026-101946
In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...
EUVD-2026-101945
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
EUVD-2026-101944
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...
EUVD-2026-101943
There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system...
EUVD-2026-101942
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...