Archive
21 March 2025
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
Medium 6.3
Stored XSS
Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.
-
Medium 4.3
xmedcon DICOM File malloc integer underflow
A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrad…
-
High 8.3
Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell…
-
High 8.8
EBM Technologies EBM Maintenance Center - SQL injection
EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.
-
Critical 9.3
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.
-
High 8.7
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS B…
-
High 7.4
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to esca…
-
Critical 9.8
PipeCD Vulnerable to Privilege Escalation
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
-
High 7.4
Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to esca…
-
High 7.4
CVE-2024-53348 in github.com/loxilb-io/loxilb
LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.
-
High 7.7
Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system…
-
High 7.3
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata'…
-
Medium 6.3
In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runti…
-
Medium 6.3
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRo…
-
Medium 6.3
In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runti…
-
High 8.6
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. T…
-
Medium 5.4
Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-rep…
-
Low 3.0
A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and…
-
High 7.2
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account tak…
-
Medium 4.0
Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read f…
-
Low 3.5
An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user …
-
Medium 5.3
An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's resp…
-
Medium 5.8
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts…
-
Medium 5.4
An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda …
-
Medium 5.4
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.