405,012 results · Feed
-
Medium 4.3
A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an att…
-
Medium 6.1
A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier …
-
Medium 6.1
A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier al…
-
Medium 4.7
A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and …
-
High 8.1
An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency…
-
High 8.8
Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to ex…
-
Medium 4.7
A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier all…
-
Medium 6.1
A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier …
-
Medium 4.7
Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unau…
-
Medium 6.1
A reflected cross-site scripting vulnerability in updates-history.php in Revive Adserver 6.0.8 and earlier allows an un…
-
Medium 5.4
An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, …
-
Medium 4.3
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restr…
-
Medium 5.5
Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnera…
-
High 8.6
In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a…
-
High 7.2
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewa…
-
Medium 4.7
Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. …
-
High 8.6
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation …
-
Critical 9.9
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled na…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScrip…
-
Unscored —
When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested arr…
-
Unscored —
When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxyg…
-
Unscored —
In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been receive…
-
Unscored —
An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS han…
-
Unscored —
proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the en…
-
Unscored —
mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a mu…
-
Unscored —
proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can …
-
High 7.1
Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization
In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. T…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels
In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that ex…
-
High 7.1
Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, includin…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receip…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, wh…
-
High 7.1
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allo…
-
Medium 6.0
repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When e…
-
Medium 6.9
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an …
-
Medium 4.8
A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local applicatio…
-
High 8.5
During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed excl…