CVE Vulnerability Catalog

W Kentico Xperience występuje podatność na zdalne wykonanie kodu, która pozwala uwierzytelnionym użytkownikom serwera synchronizacji stagingu na przesyłanie dowolnych danych do lokalizacji względnych. To prowadzi do przejścia przez ścieżkę i przesyłania dowolnych plików, w tym treści, która może być wykonywana po stronie serwera.

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.178.

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.172.

reviewdog/action-setup@v1 was compromised on March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to GitHub Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v1 are also compromised.

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.

Problem z zapisem poza przydzielonym obszarem pamięci został rozwiązany poprzez poprawione kontrole, które zapobiegają nieautoryzowanym działaniom. Problem ten został naprawiony w kilku wersjach Safari, iOS oraz macOS.

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.

A vulnerability in Windows NTFS involves insertion of sensitive information into a log file. An attacker with physical access can exploit this to disclose information.

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

A vulnerability in Windows NTLM allows external control of file name or path. An unauthorized attacker can perform spoofing over a network.

W FreeType w wersjach 2.13.0 i poniżej występuje podatność związana z zapisem poza przydzielonym obszarem pamięci podczas próby analizy struktur subglyph związanych z plikami TrueType GX i czcionkami zmiennymi. W wyniku błędnego przypisania wartości do bufora, możliwe jest zapisanie do 6 wartości typu long poza przydzielonym obszarem.

AMI's SPx contains a vulnerability in the BMC where an attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

A path equivalence vulnerability in Apache Tomcat (internal dot in file names) can lead to remote code execution, information disclosure, or malicious content added to uploaded files. It occurs when writes are enabled for the default servlet, partial PUT is supported, and other configuration conditions are met.

Edimax IC-7100 does not properly neutralize requests, allowing an attacker to craft special requests to achieve remote code execution on the device.

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.