Threat intelligence, made actionable Browse the latest NVD vulnerability records, narrow them by technology and severity, and subscribe to the categories that matter.
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve…
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in…
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. T…
SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the…
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract infor…
A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclos…
DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.
OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the WLAN module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.