CVE Vulnerability Catalog

In Johnson Controls FM Systems Employee before version 2025.3.1, there is a basic XSS vulnerability due to improper neutralization of script-related HTML tags in a web page.

In Johnson Controls FM Systems Employee before version 2025.3.1, there is a Stored XSS vulnerability due to improper neutralization of input during web page generation.

In the Johnson Controls XAAP Application on Android before version 1.53, sensitive information is stored in cleartext, allowing an attacker on a jailbroken or otherwise compromised device to retrieve that data.

HTTP Smuggling in cPanel allows potential leak of credentials.

OnionShare prior to 2.6.4 does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

OnionShare prior to 2.6.4 follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

LightFTP 2.3.1 contains an incomplete fix for CVE-2024-11144, leaving a race condition in the worker_thread_cleanup() function. A remote unauthenticated attacker can send a LIST command followed by ABOR, causing daemon instability or crash (denial of service).

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.

HCL iControl is vulnerable to sensitive data exposure. The issue stems from improper web server or application hardening, leading to public access to internal configuration files.

HCL iControl version 4.3.0 is vulnerable to security misconfiguration. The issue involves public exposure of internal configuration files due to improper web server or application hardening.

Wings, the server control plane for Pterodactyl, prior to version 1.13.0 has unbounded JSON, YAML, and XML configuration file parsers. They can process an oversized configuration file and exhaust Wings process memory.

The role-based tool permission system in pgAdmin 4 (versions 9.3-9.17) lacked consistent enforcement. The permissions_required decorator was applied only to the main route of each tool, while other backend routes and Socket.IO handlers only checked authentication, not the specific tool permission. This allowed an authenticated user without the required permission to fully use the tool (e.g., psql, backup, restore) via alternative paths.

pgAdmin 4 in SERVER mode has a vulnerability where some routes lack required authentication. An unauthenticated network client can enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users.

In Zephyr OS, a vulnerability exists in the IPv6 forwarding path where the hop limit is not decremented. This allows an IPv6 router to forward packets indefinitely, leading to network congestion and resource exhaustion.

HCL iControl is vulnerable to improper input validation. A flawed implementation of a security tactic fails to properly verify whether received input matches the expected type, potentially leading to unexpected system behavior and security bypasses.

Serendipity before version 2.6.1 contains an open redirect vulnerability in exit.php. Unauthenticated attackers can redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y.

The MasterStudy LMS plugin for WordPress (versions up to and including 3.7.39) has an insufficient verification of data authenticity vulnerability. It allows manipulating user state.

The WP Maps plugin for WordPress (versions up to and including 4.9.6) has an insertion of sensitive information into sent data vulnerability. It allows retrieving embedded sensitive data.

Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.