Archive
20 November 2025
Vulnerabilities first published on this day (UTC), newest first.
99 results · Feed
-
Low 2.4
Campcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/customer-list.php. The manipulation of the argument Name leads to cross site scripting. The attack may …
-
High 8.3
Microsoft Defender Portal Spoofing Vulnerability
Microsoft Defender Portal Spoofing Vulnerability
-
High 8.0
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
-
High 8.6
Azure Monitor Elevation of Privilege Vulnerability
Azure Monitor Elevation of Privilege Vulnerability
-
Critical 10.0
Azure Bastion Elevation of Privilege Vulnerability
Azure Bastion Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Microsoft SharePoint Online Elevation of Privilege Vulnerability
-
High 8.8
Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
IBM webMethods Integration Deserialization
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrust…
-
Medium 6.2
Command Injection in Opto22 Groov REST API
A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details…
-
Medium 6.1
IBM Concert Cross-Site Scripting
IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur…
-
Medium 5.1
IBM Concert Information Disclosure
IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying.
-
Medium 6.2
IBM Concert Improper Log Neutralization
IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output.
-
Medium 5.3
IBM Concert Information Disclosure
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system.
-
Medium 6.8
Missing Authentication for RTSP in iCam Cameras
The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera configuration information.
-
Medium 6.8
Missing Authentication for ONVIF in iCam Cameras
The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to camera configuration information.
-
Low 3.5
Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page
Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim ac…
-
High 8.8
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change oth…
-
Medium 6.3
Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected X…
-
High 8.7
Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versio…
-
Medium 6.1
Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
-
Low 3.5
Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be …
-
Low 3.5
Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XS…
-
Medium 4.3
Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes…
-
High 7.1
Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delet…
-
Medium 4.3
Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes n…
-
Low 2.7
Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions ca…
-
Medium 6.5
HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box…
-
Medium 5.4
HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the usern…
-
Medium 6.5
HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in t…
-
Critical 9.6
ABB Ability Edgenius Authentication Bypass
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
-
Low 3.3
CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the progra…
-
High 8.9
DataEase DB2 JNDI Vulnerability
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname sch…
-
Medium 6.9
Open OnDemand RPM packages create world writable locations
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
-
Medium 4.3
Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use…
-
Medium 6.8
ClipBucket v5 is vulnerable to password reset link manipulation
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Becaus…
-
High 7.3
CVE-2025-12121
Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop fil…
-
High 7.3
CVE-2025-12120
Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executab…
-
Medium 5.6
Arbitrary node_modules Directory Deletion in Google zx
When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink p…
-
Medium 6.9
Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
-
Medium 5.1
Stored XSS in SOPlanning
SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. By default only administra…