Archive
February 2025
Vulnerabilities first published in this month (UTC), newest first.
1,716 results · Clear filters · Feed
-
Medium 5.3
AppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorization
A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper of the component XPC …
-
Medium 4.0
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is en…
-
Medium 5.3
Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Lig…
-
Medium 4.3
Webkul QloApps URL mylogout cross-site request forgery
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the…
-
Medium 5.3
Out of Bounds read in the CPCA process on Check Point Management Server
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Securi…
-
Medium 4.8
Stored Cross-Site Scripting vulnerability in Holded
A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.
-
Medium 6.1
Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this …
-
Medium 6.8
Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause f…
-
Medium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may caus…
-
Medium 5.7
Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cau…
-
Medium 6.2
Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability ma…
-
Medium 6.6
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vu…
-
Medium 6.1
Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 6.2
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability…
-
Medium 6.5
Apache James: denial of service through JMAP HTML to text conversion
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
-
Medium 6.5
Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with…
-
Medium 6.3
Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Hom…
-
Medium 6.5
NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker…
-
Medium 6.5
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlie…
-
Medium 6.5
Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an att…
-
Medium 4.7
LikeBot – Decentralized like-system <= 0.85 - Admin+ Stored XSS via CSRF
The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
-
Medium 6.5
IBM App Connect Enterprise Arbitrary File Write
IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directori…
-
Medium 6.3
Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 all…
-
Medium 4.8CVE-2022-40490 Public exploit
Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerabi…
-
Medium 5.3CVE-2024-53586 Public exploit
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cr…
-
Medium 6.6
The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and F…
-
Medium 6.3CVE-2024-48589 Public exploit
Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code v…
-
Medium 4.5CVE-2024-57523 Public exploit
Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attack…
-
Medium 5.5
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topol…
-
Medium 6.1CVE-2024-57427 Public exploit
PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints imprope…
-
Medium 5.5
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Li…
-
Medium 5.4CVE-2024-57429 Public exploit
A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2…
-
Medium 4.8
Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a cr…
-
Medium 5.3
The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.
-
Medium 5.7
An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote att…
-
Medium 4.3
IBM ApplinX Information Disclosure
IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.
-
Medium 4.3
IBM ApplinX Information Disclosure
IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
-
Medium 5.9
IBM ApplinX Information Disclosure
IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techn…
-
Medium 5.4
IBM ApplinX Clickjacking
IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch furth…
-
Medium 4.3
IBM ApplinX Cross-Site Request Forgery
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.