Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about...
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Apostrophecms Sanitize Html
The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at...
AFFECTED_PRODUCTS:
Ericteubert Archivist
Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.
AFFECTED_PRODUCTS:
SonicWall Sma 200 Firmware,
SonicWall Sma 210 Firmware,
SonicWall Sma 400 Firmware
... (+2)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge
SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.
AFFECTED_PRODUCTS:
Crmeb Crmeb Java
An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' installations.
AFFECTED_PRODUCTS:
Yealink Configuration Encryption Tool
ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.
AFFECTED_PRODUCTS:
Zkteco Zkbio Wdms
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
AFFECTED_PRODUCTS:
Lfprojects Mlflow
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook.
The vulnerability stems from lack of sanitization over template variables.
AFFECTED_PRODUCTS:
Lfprojects Mlflow
Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities).
In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection.
AFFECTED_PRODUCTS:
Ethercreation Generate Barcode On Invoice \/ Delivery Slip
In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction.
AFFECTED_PRODUCTS:
Ecomiz Survey Tma
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authenticated user to potentially enable escalation of privilege via local access.
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Rejected reason: This is unused.
Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Insufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Rejected reason: This is unused.
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Rejected reason: This is unused.
Rejected reason: This is unused.
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable denial of service via local access.
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Rejected reason: This is unused.
Rejected reason: This is unused.