CVE Vulnerability Catalog

W Mbed TLS przed wersją 3.6.6 oraz 4.x przed wersją 4.1.0 oraz w TF-PSA-Crypto przed wersją 1.1.0 odkryto problem związany z przewidywalnym ziarnem w generatorze liczb pseudolosowych (PRNG).

Mbed TLS w wersjach od 3.3.0 do 3.6.5 oraz w wersji 4.0.0 umożliwia obniżenie poziomu algorytmu. Atakujący może wykorzystać tę podatność do wymuszenia użycia słabszych algorytmów kryptograficznych.

Notesnook prior to version 3.3.17 contains a stored XSS vulnerability in the mobile share / web clip flow because attacker-controlled clip metadata is concatenated into HTML without escaping and rendered via innerHTML in the editor WebView. Opening the share flow and selecting Web clip executes the malicious payload.

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights allows an authenticated, remote attacker to write arbitrary files to the system. The issue is due to insufficient validation of the metadata update file.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This is due to improper validation of user-supplied input to the management interface. An attacker could exploit this by sending crafted HTTP requests to an affected device, leading to arbitrary code execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

Vulnerability in the web-based management interface of Cisco IMC allows an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. Due to insufficient input validation. Attacker can persuade a user to click a crafted link, leading to arbitrary script execution in the browser or access to sensitive information.

Vulnerability in the web-based management interface of Cisco IMC allows an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. Due to insufficient input validation. Attacker can persuade a user to click a crafted link, leading to arbitrary script execution in the browser or access to sensitive information.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing arbitrary script execution in the browser or access to sensitive browser-based information.

Vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.

Vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.

A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This issue exists because authentication details are included in the encrypted backup files.

A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights is due to improper input validation for specific HTTP requests. An unauthenticated remote attacker could persuade an authenticated user to click a crafted link, enabling an SSRF attack and sending arbitrary network requests from the device to an attacker-controlled server.

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server versions 2026.1.6 through 2026.1.11.

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF) via a crafted API request, potentially leading to information disclosure. This affects versions 2026.1.1 through 2026.1.11 and 2025.3.1 through 2025.3.17.

In Devolutions Server versions 2026.1.6 through 2026.1.11, exposure of sensitive information in the users MFA feature allows users with user management privileges to obtain other users' OTP keys via an authenticated API request.

Devolutions Server versions 2026.1.6 through 2026.1.11 have improper access control in the users MFA feature. An authenticated user can bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request.

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.

The login mechanism of Sage DPW 2025_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.