CVE Vulnerability Catalog

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Media Picker. Malicious HTML/JS can be stored and executed in the user's browser.

Sourcerer (< 17.0.1) and Articles Anywhere (< 20.1.1) extensions for Joomla contain a PHP code injection vector. When Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity, bypassing the author trust mechanism.

The Users Anywhere extension for Joomla (regularlabs.com) before 3.0.1 exposes sensitive information to unauthorized actors. Attributes supplied inside {user}, [email] or [username] tags can override the plugin settings for that render, e.g. [email allow_output_email="1"] displays an email address even when Allow output of email is set to No.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could exploit it to gain filesystem access.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could exploit it to bypass protection mechanisms.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could exploit it to gain filesystem access.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

The product fails to sufficiently validate callback URLs, allowing manipulation with malicious payloads via weak regular expressions or omitted validation. An attacker can craft a legitimate-looking link that redirects users to an attacker-controlled page.

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.