Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Modeler
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 11.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Modeler
Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Modeler
Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Modeler
Substance3D - Modeler versions 1.22.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses an uncontrolled search path to locate critical resources such as programs, an...
AFFECTED_PRODUCTS:
Adobe Substance 3d Modeler
Photoshop Desktop versions 25.12.3, 26.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Photoshop,
Adobe Photoshop
Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Animate,
Adobe Animate
Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Animate,
Adobe Animate
Substance3D - Viewer versions 0.25 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Viewer
Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Viewer
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8
is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure withi...
AFFECTED_PRODUCTS:
IBM Websphere Application Server
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gai...
AFFECTED_PRODUCTS:
Wegia Wegia
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicar_medicamento.php endpoint, specifically in the id_fichamedica parameter. This vulnerability allows a...
AFFECTED_PRODUCTS:
Wegia Wegia
An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on t...
AFFECTED_PRODUCTS:
Fortinet FortiWeb,
Fortinet FortiWeb,
Fortinet FortiWeb
... (+1)
An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters...
AFFECTED_PRODUCTS:
Fortinet Fortiadc,
Fortinet Fortiadc,
Fortinet Fortiadc
A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.
AFFECTED_PRODUCTS:
Fortinet FortiWeb,
Fortinet FortiWeb
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration
AFFECTED_PRODUCTS:
IBM Websphere Application Server
An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR version 7.6.1 and below, version 7.5.1 and below, 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions WEB UI may allow an authenticated rem...
AFFECTED_PRODUCTS:
Fortinet Fortisoar,
Fortinet Fortisoar
A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands
AFFECTED_PRODUCTS:
Fortinet FortiWeb,
Fortinet FortiWeb
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code...
AFFECTED_PRODUCTS:
Fortinet FortiWeb,
Fortinet FortiWeb,
Fortinet FortiWeb
... (+1)
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unautho...
AFFECTED_PRODUCTS:
Fortinet Fortisiem,
Fortinet Fortisiem,
Fortinet Fortisiem
... (+2)
An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and F...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet FortiOS
... (+4)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7....
AFFECTED_PRODUCTS:
Fortinet FortiManager,
Fortinet FortiManager,
Fortinet FortiManager
... (+4)
A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacker to read arbitrary files via uploading a malicious solution pack.
AFFECTED_PRODUCTS:
Fortinet Fortisoar,
Fortinet Fortisoar
Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiMail version 7.6.0 through 7.6.1 and before 7.4.3, FortiVoice version 7.0.0 through 7.0.5 and before 7.4.9, FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4, FortiCamera & FortiNDR version 7.6.0 and before 7.4.6 ma...
AFFECTED_PRODUCTS:
Fortinet Fortimail,
Fortinet Fortimail,
Fortinet Fortivoice
... (+6)
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6.4.0 through 6.4.15 and before 6.2.16, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and before 7.0.15 & FortiPAM before version 1.2.0 allows an unauthenticated attacker to...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet Fortiproxy
... (+5)
A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to exec...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet FortiOS
... (+4)
Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
AFFECTED_PRODUCTS:
Microsoft Azure Stack Hub,
Microsoft Azure Stack Hub,
Microsoft Azure Stack Hub
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2016,
Microsoft Windows Server 2019,
Microsoft Windows 10 1507
... (+10)
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Subsystem For Linux
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office Long Term Servicing Channel,
Microsoft Office Long Term Servicing Channel
Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
AFFECTED_PRODUCTS:
Microsoft Teams,
Microsoft Teams,
Microsoft Teams
... (+5)
Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.
Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2025
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+15)
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Visual Studio 2022
Deserialization of untrusted data in Web Deploy allows an authorized attacker to execute code over a network.
AFFECTED_PRODUCTS:
Microsoft Web Deploy 4.0
External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
AFFECTED_PRODUCTS:
Microsoft Windows Security App
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Office,
Microsoft Windows Server 2008
... (+17)