MEDIUM Severity CVEs

Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.asp

yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources

yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /

SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" paramete

On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism reli

In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for t

yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressD

yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authentica

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthor

Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to uplo

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesy

An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs p

A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unkno

A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affec

A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affec

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator en

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.

A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.p

A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling Syst

SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to es

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, ma

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access se

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access se

A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php vi

Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parame

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the

N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Custom

A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary c

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.ph

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program

Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Mana

Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization

Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization

Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forg

Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly cons

A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0

A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attack

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teach

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions

The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allo

An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and

An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, versi

A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 t

FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and For

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version

An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 i