CVE Vulnerability Catalog

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could exploit it to elevate privileges.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low-privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary files and override existing files in a temporary folder, which might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

An information disclosure vulnerability in the Forocoches comments editor allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user's privacy.

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back.

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause.

Apache Fineract (through version 1.15.0) is vulnerable to SQL Injection in the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance endpoint. Insufficient input neutralization allows SQL code injection.

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response, and invalid authentication attempts can trigger full deserialization of this cached data.