MEDIUM Severity CVEs

A vulnerability was found in ESAFENET CDG V5. It has been classified as critical. Affected is an unknown function of the

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listi

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the fil

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy

In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a

In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Cod

A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated rem

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated rem

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated rem

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticat

A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Compose

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when a

In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninit

In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. Thi

In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input val

EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are

An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged locati

A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affect

The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of

A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkConta

A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently e

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior

Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid s

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter

The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, a

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows enviro

NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm

NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A suc

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been free

NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data is

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could le

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that appl

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ contai

IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker w

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obt

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote

IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be

An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.

An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a

Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access sys

Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbit

The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4,

This issue was addressed through improved state management. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3

The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequ