Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially all...
AFFECTED_PRODUCTS:
Sulu Sulu,
Sulu Sulu
async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10.
Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgr...
AFFECTED_PRODUCTS:
Netapp Ontap Tools,
Netapp Ontap Tools,
Apache Commons Io
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
AFFECTED_PRODUCTS:
Canonical Authd
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4Â or 1.12.0, which fix this issue.
AFFECTED_PRODUCTS:
Apache Avro
A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.
Deep Freeze 9.00.020.5760 is vulnerable to an out-of-bounds read vulnerability by triggering the 0x70014 IOCTL code of the FarDisk.sys driver.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files...
AFFECTED_PRODUCTS:
Hypestudio Social Web Suite
Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier. Having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier may cause a deni...
AFFECTED_PRODUCTS:
Jtekt Kostac Plc
Stack-based buffer overflow vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier. Having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier may cau...
AFFECTED_PRODUCTS:
Jtekt Kostac Plc
Out-of-bounds write vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier. Having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier may cause a den...
AFFECTED_PRODUCTS:
Electronics.jtekt Kostac Plc Programming Software,
Electronics.jtekt Kostac Plc Programming Software
Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium service...
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration,
Zimbra Collaboration
... (+2)
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker n...
AFFECTED_PRODUCTS:
Foxit Pdf Reader
Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component.
AFFECTED_PRODUCTS:
Ruijie Rg Nbs2009g P Firmware
A potential security vulnerability
has been identified in the HP One Agent for certain HP PC products, which might
allow for escalation of privilege. HP is releasing software updates to mitigate
this potential vulnerability.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see...
AFFECTED_PRODUCTS:
Openc3 Cosmos
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#sh...
AFFECTED_PRODUCTS:
Openc3 Cosmos
Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.
AFFECTED_PRODUCTS:
Contao Contao,
Contao Contao,
Contao Contao
Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.
AFFECTED_PRODUCTS:
Tribalsystems Zenario
October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.
AFFECTED_PRODUCTS:
Octobercms October
Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.
AFFECTED_PRODUCTS:
Tribalsystems Zenario
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and n...
AFFECTED_PRODUCTS:
Openc3 Cosmos
The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate li...
AFFECTED_PRODUCTS:
Slimselectjs Slim Select
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
AFFECTED_PRODUCTS:
Ruijie Rg Nbs2009g P Firmware
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device.
This vulnerability is due to insu...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN servi...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vulnerability is due to insufficient resource management while establishi...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device.
These vulnerabilities are due to insufficie...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device.
This vulnerability is due to insufficient resource m...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device.
These vulnerabilities are due to insufficie...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device.
These vulnerabilities are due to insufficie...
AFFECTED_PRODUCTS:
Cisco Meraki Mx64w Firmware,
Cisco Meraki Mx65w Firmware,
Cisco Meraki Mx67w Firmware
... (+22)
A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restart t...
AFFECTED_PRODUCTS:
Wondershare Edraw
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
AFFECTED_PRODUCTS:
Os4Ed Opensis
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
AFFECTED_PRODUCTS:
Flatpress Flatpress
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service (DoS) condition. To exploit t...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service (DoS) condition. To exploit t...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service (DoS) condition. To exploit t...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Adm...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Adm...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Adm...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Adm...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service (DoS) condition. To exploit t...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service (DoS) condition. To exploit t...
AFFECTED_PRODUCTS:
Cisco Rv320 Firmware,
Cisco Rv320 Firmware,
Cisco Rv320 Firmware
... (+153)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device.
This vulnerability is due to a lack of proper data protection mechanisms for certain configuration s...
AFFECTED_PRODUCTS:
Cisco Identity Services Engine,
Cisco Identity Services Engine,
Cisco Identity Services Engine
... (+3)
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credential...
AFFECTED_PRODUCTS:
Cisco Telepresence Video Communication Server,
Cisco Telepresence Video Communication Server,
Cisco Telepresence Video Communication Server
... (+76)
A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information.
This vulnerability exists because remote controller credentials are recorded in an internal log that is stored in the tech support file...
AFFECTED_PRODUCTS:
Cisco Nexus Dashboard Fabric Controller,
Cisco Nexus Dashboard Insights,
Cisco Nexus Dashboard Insights
... (+2)
A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information.
This vulnerability exists because HTTP proxy credentials could be recorded...
AFFECTED_PRODUCTS:
Cisco Nexus Dashboard Fabric Controller,
Cisco Nexus Dashboard Insights,
Cisco Nexus Dashboard Insights
... (+2)
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device.
This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exp...
AFFECTED_PRODUCTS:
Cisco Nexus Dashboard,
Cisco Nexus Dashboard Fabric Controller