MEDIUM Severity CVEs

A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitr

A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual

A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network

A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manip

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthent

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authentica

The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the C

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

The ns_backup extension through 13.0.0 for TYPO3 allows command injection.

The cs_seo extension through 9.2.0 for TYPO3 allows XSS.

The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.

A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classifie

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning va

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4B

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_p

AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.

The certificate and private key used for providing transport layer security for connections to the web interface (TCP po

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The

The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader

The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all v

The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_yo

The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts

The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_don

The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ param

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishi

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network ac

The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versi

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the Amazo

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown par

A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination o

A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical.

A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected

A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerab

A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function U

Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to versio

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0.

In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add error handling for brcmf