CVE Vulnerability Catalog

A Path Traversal vulnerability in the Outlookproxy plugin of Fortinet FortiDLP Agent for macOS allows an authenticated attacker to escalate privileges to Root by sending a crafted request to a local listening port.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows versions 11.5.1, 11.4.2-11.4.6, 11.3.2-11.3.4, 11.2.0-11.2.3, 11.1.1-11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port.

An Exposure of Private Personal Information ('Privacy Violation') vulnerability in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows in versions 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.

In Fortinet FortiDLP versions 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5, there is an insertion of sensitive information into log files, allowing an attacker to disclose information by reusing the enrollment code.

Wykryto lukę bezpieczeństwa w GNU Binutils 2.45, dotyczącą funkcji tg_tag_type w pliku prdbg.c. Manipulacja tą funkcją prowadzi do braku kontroli wartości zwracanej, co może być wykorzystane w atakach lokalnych.

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.

desknet's NEO versions V4.0R1.0 to V9.0R2.0 contain a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.

In desknet's NEO V4.0R1.0 to V9.0R2.0, there is an Improper Protection of Alternate Path (CWE-424) vulnerability in the AppSuite that allows an attacker to create malicious AppSuite applications.

In desknet's NEO V2.0R1.0 to V9.0R2.0, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.

In desknet's NEO V9.0R2.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.

Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.

Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.

An inefficient regular expression complexity (ReDoS) vulnerability has been found in Apache Traffic Control. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. The project is retired and no fix is planned.

ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.

Deserialization of untrusted data vulnerability in Apache ActiveMQ NMS AMQP Client (all versions up to and including 2.3.0) when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic to execute arbitrary code on the client side. The protection mechanism from version 2.1.0 can be bypassed.

ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.

ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.

HCL BigFix Mobile version 3.3 and earlier have insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

HCL BigFix Modern Client Management (MCM) version 3.3 and earlier have insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.