CVE Vulnerability Catalog

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated attacker with read-only permissions to elevate privileges to high. The issue is due to sensitive session information being recorded in audit logs.

HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.

HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions.

HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.

HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions.

HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behavior may allow exposure of data to external systems under specific conditions.

Prior to 1.2.3, Flowsint allows a remote attacker to create a node with a malicious description containing arbitrary HTML, which is rendered when the node is selected, potentially triggering stored XSS.

Backstage to otwarte środowisko do budowania portali deweloperskich. W wersjach przed 0.6.11, nieprzetworzone encje w punktach końcowych @backstage/plugin-catalog-backend-module-unprocessed nie wymuszają sprawdzania uprawnień, co pozwala każdemu uwierzytelnionemu użytkownikowi na dostęp do nieprzetworzonych rekordów encji, niezależnie od ich właściciela.

Open OnDemand (an HPC portal) before versions 4.0.11, 4.1.5, and 4.2.2 allows specially crafted filenames to execute JavaScript in the file browser. Fixed in 4.0.11, 4.1.5, and 4.2.2.

Spring Cloud AWS from 3.0.0 to 4.0.1 does not verify the signature of incoming SNS messages in its HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping). An unauthenticated attacker who knows the endpoint URL can send crafted HTTP POST requests mimicking SNS notifications.

Vvveb before version 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

Vvveb before version 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow. The Signup::addUser() controller copies raw POST username values into the display_name field before sanitization, allowing attackers to inject HTML and script markup.

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 contains a cross-site scripting (XSS) vulnerability. The flaw allows injection of malicious script that may execute in a user's browser.

Verba jest podatna na atak typu Stored Cross-Site Scripting (XSS) w mechanizmie logowania. Nieautoryzowany atakujący może wprowadzić złośliwy ładunek XSS w polu nazwy użytkownika, który zostanie zapisany w logach aplikacji.

Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, control the Archon UI features, and steal all Archon information available on the UI including API keys.

A covert timing channel in the comparison of MD5-hashed passwords in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, existing databases may have MD5-hashed passwords from upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

WEBCON BPS is vulnerable to reflected XSS via one of the parameters used by the "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. The issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Authorization bypass through a user-controlled key in DijiDemi (Im Park Information Technology) allows privilege abuse. Affects versions from 4.5.12.1 before 4.5.13.0.

Podinfo up to version 6.11.2 contains a reflected XSS vulnerability in the /echo and /api/echo endpoints. The echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers, allowing attackers to execute scripts in the podinfo origin context.