MEDIUM Severity CVEs

Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.

Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoof

An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated a

The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an a

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity an

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen gen

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 throu

A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability i

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerabi

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiA

An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, F

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive infor

An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext password

An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server wi

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that co

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event par

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their ni

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns al

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync stre

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy name

Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwrit

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user p

Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges cou

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform un

SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacke

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP reques

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks f

The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational d

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which coul

Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could

Affected Product(s)Version(s)InfoSphere Data Architect9.2.1

IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain s

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Seri

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink t

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1