CVE Vulnerability Catalog

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox.

Apache Syncope has an authorization bypass through a user-controlled key vulnerability. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination.

The Apache Arrow Rust crate (`arrow`) from version 33.0.0 through 57.3.1, 58.4.0, 59.3.1 and 60.0.0 has an out-of-bounds read vulnerability. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.

Apache Syncope has an improper privilege management vulnerability. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process; when a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server with no sandbox.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Mega Menu Badge Text field. Malicious HTML/JS can be stored and executed in the user's browser.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Media Picker. Malicious HTML/JS can be stored and executed in the user's browser.

Sourcerer (< 17.0.1) and Articles Anywhere (< 20.1.1) extensions for Joomla contain a PHP code injection vector. When Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity, bypassing the author trust mechanism.

The Users Anywhere extension for Joomla (regularlabs.com) before 3.0.1 exposes sensitive information to unauthorized actors. Attributes supplied inside {user}, [email] or [username] tags can override the plugin settings for that render, e.g. [email allow_output_email="1"] displays an email address even when Allow output of email is set to No.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.