CVE Vulnerability Catalog

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit this information to launch targeted attacks, such as remote code execution or denial of service.

HCL Unica Centralized Offer Management is vulnerable to Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.

A flaw in code-projects Hospital Management System 1.0 affects the session function of the express-session component. Manipulation of the secret argument with input 'secret' causes use of a hard-coded cryptographic key. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit has been published.

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.

A vulnerability related to trusted types in scripts not being enforced in CSP was identified in HCL AION version 2.0.

A Cacheable SSL Page Found vulnerability was identified in HCL AION version 2.0. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability was identified in HCL AION version 2.0.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability was identified in HCL AION version 2.0.

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics v6.6 allows loading third-party scripts without integrity checks or validation, which can allow external code to run in the application's context, risking data exposure.

Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access the recent app list.

An information disclosure vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked. The risk is significantly minimized when CLI access is restricted to a limited group of administrators; Cloud NGFW and Prisma Access are not affected.

In GNU Binutils 2.45, the elf_x86_64_relocate_section function in elf64-x86-64.c of the Linker component has a heap-based buffer overflow. The attack can only be executed locally, and the exploit has been publicly disclosed. It is recommended to deploy the patch named 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0.

In GNU Binutils 2.45, the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c of the Linker component has an out-of-bounds read. The attack needs to be approached locally, and the exploit has been made public. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a.

A vulnerability in SourceCodester Student Grades Management System 1.0 affects the add_user function in /admin.php of the Manage Users Page component. Manipulation of first_name/last_name arguments causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed.

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet.