CVE Vulnerability Catalog

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup.

IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

A race condition vulnerability in Apple systems, fixed with additional validation. A local user may cause unexpected system termination or read kernel memory.

An out-of-bounds write issue in Apple products was addressed with improved bounds checking. A remote attacker may be able to cause unexpected app termination or arbitrary code execution. This issue is fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.

An integer overflow vulnerability in Apple systems, fixed with improved input validation. An app may cause a denial of service.

A null pointer dereference vulnerability in Apple systems, fixed with improved input validation. Processing web content may lead to a denial-of-service.

A path handling issue in Apple systems, fixed with improved validation. An app may be able to modify protected parts of the file system.

A vulnerability in Apple systems, fixed with improved checks. An app may cause unexpected system termination.

A type confusion issue in Apple systems, fixed with improved memory handling. An app may cause a denial of service.

An integer overflow vulnerability in Apple systems, fixed with improved input validation. An app may cause unexpected system termination.

A use after free issue in Apple systems, fixed with improved memory management. An app may cause unexpected system termination.

A logic issue was addressed with improved validation. The vulnerability affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may be able to access sensitive user data.

A memory initialization issue was addressed with improved memory handling. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to determine kernel memory layout.

An authorization issue was addressed with improved state management. The vulnerability affects iOS, iPadOS, and macOS. A malicious application may be able to bypass Privacy preferences.

This issue was addressed with improved checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to access sensitive user data.

A use after free issue was addressed with improved memory management. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to cause unexpected system termination.

A race condition was addressed with improved state handling. The vulnerability affects macOS Golden Gate 27 and macOS Tahoe 26.7. An app may be able to cause unexpected system termination.