2025

conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Be

Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vu

This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with c

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system c

Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.

MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors

Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local proje

Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an ar

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Va

gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS

scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to logi

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process,

A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion

Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interf

Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitra

Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confident

A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attack

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote at

Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an

Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Test

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and

Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an atta

User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows a

The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allow

The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09

Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords

Input from multiple fields in Streamsoft Prestiż is not sanitized properly, leading to an SQL injection vulnerability, w

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered

The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allow

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design

Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows att

Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inco

Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest acc

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential envir

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allo

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an

An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may

An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in

An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an I

An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used

A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may a

An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may all

An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APR

An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticat

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthentic