12,440 results · Clear filters · Feed
-
Low 2.4
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadO…
-
Low 3.3
An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7…
-
Low 3.3
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sono…
-
Low 3.3
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password ma…
-
Low 3.3
The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17…
-
Low 3.3
This issue was addressed with improved data protection. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, w…
-
Low 3.5
Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerabili…
-
Low 3.5
SourceCodester Complaints Report Management System cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Complaints Report Management System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name …
-
Low 3.5
TOTOLINK A3000RU product.ini hard-coded password
A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini. The manipulation leads to use of hard-coded password. The exploit has been disclos…
-
Low 3.5
SeaCMS index.php cross site scripting
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to init…
-
Low 3.5
SeaCMS cross site scripting
A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/player/dmplayer/admin/post.php?act=setting. The manipulation of the argument yzm leads to cross site …
-
Low 2.5
TOTOLINK A3300R shadow.sample hard-coded password
A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. It is poss…
-
Low 2.8
An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted applicatio…
-
Low 3.3
An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security thr…
-
Low 2.2
In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restr…
-
Low 2.7
Improper Control of Resource Identifiers ('Resource Injection') in GitLab
A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.
-
Low 2.6
Exposure of Sensitive Information to an Unauthorized Actor in GitLab
An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.
-
Low 3.1
There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitb…
-
Low 2.4
IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727.
-
Low 3.5
SourceCodester Insurance Management System update_sub_category cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/admin/core/update_sub_category. The manipulation of the argument name leads to cross site scripting. I…
-
Low 3.5
In-Fabric Matter Cluster Attribute Disclosure
An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose information about devices part of the same fabric (footprinting), even though the protocol is designed to pr…
-
Low 3.1
macidn punycode buffer overread
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to us…
-
Low 3.5
Canarytoken "Cloned Website" Vulnerable to Stored Cross-Site Scripting
Canarytokens help track activity and actions on a network. A Cross-Site Scripting vulnerability was identified in the "Cloned Website" Canarytoken, whereby the Canarytoken's creator can attack themselves. The creator of a slow-redirect Canarytoken can insert …
-
Low 3.5
Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect th…
-
Low 3.5
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
-
Low 2.6
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
-
Low 3.5
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
-
Low 3.1CVE-2024-32152 EPSS 12%
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerabili…
-
Low 3.9
Apache Syncope: HTML tags can be injected into Console or Enduser text fields
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. …
-
Low 3.5
SourceCodester Record Management System sort2.php cross site scripting
A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file sort2.php. The manipulation of the argument qualification leads to cross site scripting. It is possibl…
-
Low 3.5
SourceCodester Record Management System sort1.php cross site scripting
A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file sort1.php. The manipulation of the argument position leads to cross site scri…
-
Low 3.5
ThinkSAAS Admin Panel Security Center anti.php cross site scripting
A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to c…
-
Low 3.5
ThinkSAAS do.php cross site scripting
A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/action/do.php. The manipulation of the argument site_title/site_subtitle/site_key/site_desc/site_url/sit…
-
Low 3.5
Xinhu RockOA tpl_upload.html okla cross site scripting
A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack …
-
Low 3.5
SiYuan PDF PDF.js cross site scripting
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of the component PDF Handler. The manipulation leads to cross site scripting. The attack can be launche…
-
Low 2.7
formtools.org Form Tools Import Option List edit.php curl_exec file inclusion
A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List. The manipulation of the argument url lead…
-
Low 2.7
formtools.org Form Tools Setting code injection
A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the ar…
-
Low 2.4
formtools.org Form Tools User Settings Page cross site scripting
A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to cross site scripting. The attack can be i…
-
Low 2.4
formtools.org Form Tools cross site scripting
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It…
-
Low 3.5
ClassCMS cross site scripting
A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?action=home&do=shop:index&keyword=&kind=all. The manipulation of the argument order leads to cross s…