CVE Vulnerability Catalog

Apache Syncope has an improper privilege management vulnerability. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process; when a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server with no sandbox.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Mega Menu Badge Text field. Malicious HTML/JS can be stored and executed in the user's browser.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Media Picker. Malicious HTML/JS can be stored and executed in the user's browser.

Sourcerer (< 17.0.1) and Articles Anywhere (< 20.1.1) extensions for Joomla contain a PHP code injection vector. When Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity, bypassing the author trust mechanism.

The Users Anywhere extension for Joomla (regularlabs.com) before 3.0.1 exposes sensitive information to unauthorized actors. Attributes supplied inside {user}, [email] or [username] tags can override the plugin settings for that render, e.g. [email allow_output_email="1"] displays an email address even when Allow output of email is set to No.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could exploit it to gain filesystem access.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could exploit it to bypass protection mechanisms.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could exploit it to gain filesystem access.