CVE Vulnerability Catalog

A flaw in the user interface of Microsoft Exchange Server leads to misrepresentation of critical information, allowing an unauthorized attacker to perform spoofing over a network.

A cross-site scripting (XSS) vulnerability was found in phpIPAM v1.7.3 in the Request IP form. It allows remote attackers to inject arbitrary web script or HTML via the instructions parameter at the /app/admin/instructions/edit-result.php endpoint.

Podatność CVE-2025-6924 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Talent Software e-BAP Automation, co pozwala na wystąpienie ataków typu Reflected XSS.

Podatność CVE-2025-6923 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Talent Software UNIS, co pozwala na ataki typu Reflected XSS.

Podatność CVE-2025-10876 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Talent Software e-BAP Automation, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji e-BAP Automation od 1.8.96 do przed v.41815.

In the Attachment service of usememos memos v0.25.2, a lack of file name validation allows attackers to perform a path traversal. This vulnerability enables access to files outside the intended directory.

An incorrect access control vulnerability in the Identity Provider service of usememos memos v0.25.2 allows low-privileged attackers to arbitrarily modify or delete registered identity providers. This can lead to account takeover or Denial of Service (DoS).

W wielu plikach istnieje możliwość ujawnienia informacji między użytkownikami z powodu braku sprawdzenia uprawnień. Może to prowadzić do lokalnego ujawnienia informacji bez potrzeby dodatkowych uprawnień wykonawczych.

In usememos memos version 0.25.2, incorrect access control allows attackers with low-level privileges to arbitrarily modify or delete attachments created by other users.

In usememos memos version 0.25.2, an incorrect access control allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.

A permission control vulnerability in the window management module. Exploitation may impact system availability.

A flaw was found in util-linux that allows a heap buffer overread when processing 256-byte usernames in the `setpwnam()` function. This affects SUID login-utils utilities that write to the password database.

A file upload vulnerability in Fanvil x210 V2 version 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.

An issue was discovered in Fanvil x210 V2 version 2.12.20 that allows unauthenticated attackers on the local network to execute arbitrary system commands.

A vulnerability in HCLTech GRAGON before version 7.6.0 allows a remote attacker to execute arbitrary code via APIs that do not enforce limits on the number or size of requests.

A Cross Site Scripting (XSS) vulnerability was found in HCLTech DRAGON prior to version 7.6.0. Missing security directives allow a remote attacker to execute arbitrary code in the victim's browser context.

A vulnerability in Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in a local file using a weak obfuscation scheme. The password is 'encrypted' through predictable byte-substitution that can be trivially reversed, allowing immediate recovery of the plaintext value.

A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH DGM1104 allows attackers to inject malicious JavaScript or HTML into the username field. Successful exploitation enables arbitrary script execution in the victim's browser context.

An authenticated command injection vulnerability was discovered in the test_mail function of AVTECH SECURITY DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows an attacker to execute arbitrary system commands via crafted input.

In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.