| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. |
| Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection. |
| XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks. |
| Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments. |
| The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification. |
| Default credentials permit access through AcuXDBC. |
| Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. |
| Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise. |
| Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation.
This issue affects C-Prot AppDefense: before 1.0.2729. |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection.
This issue affects oPanel: before 1.20.66. |
| An exposure of the appliance’s confidential certificate information
vulnerability exists in HPE Morpheus manager software. |
| When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. |
| http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3. |
| XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack. |
| The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications. |
| The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site. |
| The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor. |
| The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities. |
| The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin. |
| The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address). |
