Baza CVE

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to…

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be…

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.p…

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php…

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML…

A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a…

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component…

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation…

Obejście autoryzacji w ToolJet umożliwia ujawnienie schematów baz danych i eksport aplikacji.

Obejście uwierzytelnienia w ToolJet umożliwia manipulację tabelami w innych przestrzeniach roboczych.

Wielokrotne wstrzyknięcie skryptów w pdfme pozwala na wykonanie złośliwego kodu przez atakujących.

Wtyczka Select w @pdfme/schemas przed 5.5.9 ma lukę XSS, umożliwiającą wykonanie kodu w przeglądarkach.

Wtyczka SVG w @pdfme/schemas umożliwia atak XSS przez niezabezpieczone wstawianie SVG.

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of…

Wstrzyknięcie poleceń SMTP w Nodemailer umożliwia fałszowanie wiadomości e-mail.

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD…

A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the…

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component…

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file…

Nodemailer umożliwia atakującym odczyt lokalnych plików lub pobieranie URL-i przez błędne zabezpieczenia.

Wstrzyknięcie nagłówków w Nodemailer umożliwia atakującym manipulację wiadomościami e-mail.

Wykorzystanie podatności w Nodemailer pozwala na atak typu DoS poprzez złośliwe załączniki.

Luka w domyślnym obrazie Docker Venueless pozwala na dostarczenie złośliwego kodu JavaScript w plikach SVG.

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file…

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/…