MEDIUM Severity CVEs

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. I

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or s

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a loca

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnera

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a tab

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of

HCL AION is affected by a vulnerability where the shared storage used by product components is architected without suffi

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-UR

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keywor

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file an

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configure

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the admin

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that ret

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endp

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anony

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoi

: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or non

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit res

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `pp

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protect

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentica

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-statu

VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly spec

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authen

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authentic

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a laten

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOT

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower G

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secr

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_functi

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying th