Filtered by CWE-284
Filtered by vendor Subscriptions
Total 4207 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-0143 1 Forgerock 1 Ldap Connector 2025-05-29 9.3 Critical
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (RCS)
CVE-2022-32883 1 Apple 4 Ipados, Iphone Os, Macos and 1 more 2025-05-29 5.5 Medium
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to read sensitive location information.
CVE-2024-13191 1 Zerowdd 1 Myblog 2025-05-28 6.3 Medium
A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4051 1 Google 1 Chrome 2025-05-28 6.3 Medium
Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-25225 1 Hikashop 1 Hikashop 2025-05-28 6.5 Medium
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
CVE-2023-45210 1 Pleasanter 1 Pleasanter 2025-05-28 4.3 Medium
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.
CVE-2022-32880 1 Apple 1 Macos 2025-05-28 6.5 Medium
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data.
CVE-2025-46566 1 Dataease 1 Dataease 2025-05-28 9.8 Critical
DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.9.
CVE-2025-3123 1 Wondercms 1 Wondercms 2025-05-28 4.7 Medium
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he philosophy has always been, admin [...] bear responsibility to not install themes/plugins from untrusted sources."
CVE-2025-28104 1 Dogukanurker 1 Flaskblog 2025-05-28 9.1 Critical
Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.
CVE-2022-41235 1 Jenkins 1 Wildfly Deployer 2025-05-28 5.3 Medium
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
CVE-2025-3236 1 Tenda 2 Fh1202, Fh1202 Firmware 2025-05-28 5.3 Medium
A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/VirSerDMZ of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3237 1 Tenda 2 Fh1202, Fh1202 Firmware 2025-05-28 5.3 Medium
A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/wrlwpsset. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4735 1 Campcodes 1 Sales And Inventory System 2025-05-28 6.3 Medium
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-35621 1 Evohclaimable Project 1 Evohclaimable 2025-05-28 5.3 Medium
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.
CVE-2025-4923 1 Lerouxyxchire 1 Client Database Management System 2025-05-28 7.3 High
A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /user_delivery_update.php. The manipulation of the argument uploaded_file_cancelled leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-5059 1 Campcodes 1 Online Shopping Portal 2025-05-28 4.7 Medium
A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument productimage1/productimage2/productimage3 leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4751 1 Dlink 2 Di-7003g, Di-7003g Firmware 2025-05-27 5.3 Medium
A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.data. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-26770 1 Taskcafe Project 1 Taskcafe 2025-05-27 9.8 Critical
TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.
CVE-2025-4904 1 Dlink 2 Di-7003g, Di-7003g Firmware 2025-05-27 5.3 Medium
A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of the file /H5/webgl.data. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.