Archive
18 March 2025
Vulnerabilities first published on this day (UTC), newest first.
21 results · Clear filters · Feed
-
Medium 6.0
Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface
Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, poten…
-
Medium 4.3
Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface
A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentiall…
-
Medium 6.9
imFAQ allows local file inclusion in seo.php
imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the…
-
Medium 4.8
Contao allows cross-site scripting through SVG uploads
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
-
Medium 4.9
389-ds-base: null pointer dereference leads to denial of service
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN o…
-
Medium 4.1
IBM QRadar Advisor server-side request forgery
IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
-
Medium 5.3
Stored Cross-Site Scripting (XSS) vulnerability in Softdial Contact Center
Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute wh…
-
Medium 6.8
Insecure storage of sensitive information in NTFS Tool
Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
-
Medium 5.3
CODESYS (Edge) Gateway for Windows insecure default
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
-
Medium 6.6
CODESYS Control V3 removable media path traversal
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
-
Medium 6.8
SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code vi…
-
Medium 6.5
SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" paramet…
-
Medium 6.5
TastyIgniter Has an Incorrect Access Control Vulnerability
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if th…
-
Medium 6.5
In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for …
-
Medium 4.6
An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging…
-
Medium 6.5
On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism rel…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at …
-
Medium 4.2
yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resource…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xm…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/Address…
-
Medium 6.5
Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.as…