CVE Vulnerability Catalog

Zidentyfikowano podatność w HCL AION v2.0, która pozwala na wykonywanie skryptów inline w polityce CSP.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability was identified in HCL AION version 2.0.

A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability exists in HCL AION. This issue affects AION version 2.0.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability was identified in HCL AION version 2.0.

Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock' widget. Next, modify the 'Configuration Name' field in the left-hand section.

Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload.

Elasticsearch inserts sensitive information into log files when auditing requests to the reindex API. Under specific preconditions, this can lead to a loss of confidentiality.

Apache StreamPark versions 2.1.4 through 2.1.5 have an incorrect execution-assigned permissions vulnerability. The issue is fixed in version 2.1.6.

Stored XSS vulnerability in Kibana. Improper input neutralization during page generation can lead to persistent XSS attacks.

Kibana contains an XSS vulnerability due to improper neutralization of input during web page generation.

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics v6.6 allows loading third-party scripts without integrity checks or validation, which can allow external code to run in the application's context, risking data exposure.

Energy CRM v2025 by Status Tracker Ltd has a stored XSS vulnerability due to lack of proper validation of user input when sending a POST request to “/crm/create_invoice_submit.php” using the “customerName_0” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.

An out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory.

Samsung Notes prior to version 4.4.30.63 has an out-of-bounds read vulnerability during parsing of image data, allowing local attackers to access out-of-bounds memory.

An out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.

An out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.

An out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.

Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.

Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.